Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 19:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
df5723e1c7644fc99bc41286bd1cafb89a6b34f964b1c54948928fa498bacb2b.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
df5723e1c7644fc99bc41286bd1cafb89a6b34f964b1c54948928fa498bacb2b.exe
-
Size
346KB
-
MD5
0718da64b1efc2978471ad77f81d59b3
-
SHA1
30786507d1451ed793afb07311e9ed2503018220
-
SHA256
df5723e1c7644fc99bc41286bd1cafb89a6b34f964b1c54948928fa498bacb2b
-
SHA512
6e38409431bd2ccb491d90fbc2a742885b3bff99038ebd785040500bf7d58a512f0cff300b04687e261b5c0fd9557780940f913e55569bdd8021064231a2c098
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYAO:l7TcbWXZshJX2VGdO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4608-6-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/228-11-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2944-18-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2388-22-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4168-29-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1944-36-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2248-42-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/624-47-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3496-53-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/968-59-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1144-64-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1084-70-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1456-76-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3344-82-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3132-88-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1620-96-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2208-94-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3272-106-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3252-112-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2468-119-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4416-130-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/684-134-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4308-142-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4144-148-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5008-155-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3384-164-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3056-176-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2096-172-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/920-195-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1012-196-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1052-212-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5076-219-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4832-226-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/112-230-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2056-234-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1672-244-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1864-251-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4404-257-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4516-267-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3536-281-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2552-304-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1636-308-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3360-327-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4200-343-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1920-353-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/876-357-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1128-361-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/964-374-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1488-408-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1668-424-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4140-452-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4488-462-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4740-515-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2164-519-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3056-602-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5064-612-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4036-628-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5060-695-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2040-798-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/456-820-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1984-1108-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3880-1432-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1624-1888-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 228 7xrlxrl.exe 2944 htnbth.exe 2388 fxrlxrl.exe 4168 1ttnbb.exe 1944 pjjdd.exe 2248 tnhbnn.exe 624 jppvj.exe 3496 htbhnt.exe 968 dpjpd.exe 1144 xxxrlfx.exe 1084 pvvjj.exe 1456 xrfrrll.exe 3344 tttnbt.exe 3132 pdpdp.exe 1620 3fxxrlf.exe 2208 vddpj.exe 3272 3jpjv.exe 3252 9xxxllf.exe 2468 1vdpd.exe 4836 lrxlxxl.exe 4416 nbbnbt.exe 684 pddvp.exe 4308 lflllff.exe 4144 hnnhtn.exe 5008 frffrrr.exe 3128 ntnbtn.exe 3384 hbhthb.exe 2096 jddpj.exe 3056 bhbnbt.exe 1428 bnbnhb.exe 5064 3dvpv.exe 4984 rlllxrf.exe 920 7hhtnh.exe 1012 jvpjd.exe 2260 lrxrxrf.exe 4044 btnnhb.exe 2988 jjppp.exe 1052 9ffxrlf.exe 4304 pdpjv.exe 5076 vjdvj.exe 5092 rrrlfxl.exe 4832 hntnhh.exe 112 hbbthb.exe 2056 rrrlxxr.exe 4584 hhbhbn.exe 1504 jddvp.exe 1672 lffxlfx.exe 1732 rfffxxx.exe 1864 tbbthb.exe 1136 dvddp.exe 4404 fffxxrr.exe 2052 xrrlxrx.exe 4608 hhttbb.exe 4516 dvpjv.exe 5112 lrrlxrl.exe 664 lllxrrl.exe 3752 jjpvp.exe 3536 7frflxx.exe 820 frlxlfr.exe 1300 hnthhn.exe 2948 hnhtbn.exe 3372 pddvv.exe 1560 rrfrxrr.exe 752 xffrxlx.exe -
resource yara_rule behavioral2/memory/4608-6-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/228-11-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2944-18-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2388-22-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4168-29-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1944-36-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2248-42-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/624-47-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3496-53-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/968-59-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1144-64-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1084-70-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1456-76-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3344-82-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3132-88-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1620-96-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2208-94-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3272-106-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3252-112-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2468-119-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4416-130-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/684-134-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4144-143-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4308-142-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4144-148-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5008-155-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3384-164-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3056-176-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2096-172-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/920-195-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1012-196-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1052-212-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5076-219-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4832-226-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/112-230-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2056-234-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1672-244-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1864-251-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4404-257-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4516-267-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3536-277-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3536-281-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2552-304-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1636-308-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3360-327-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4200-343-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1920-353-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/876-357-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1128-361-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/964-374-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1488-408-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1668-424-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4140-452-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4488-462-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4720-490-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4740-515-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2164-519-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1936-523-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3056-602-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5064-612-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4036-628-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5060-695-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2040-798-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/456-820-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lrlxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4608 wrote to memory of 228 4608 df5723e1c7644fc99bc41286bd1cafb89a6b34f964b1c54948928fa498bacb2b.exe 82 PID 4608 wrote to memory of 228 4608 df5723e1c7644fc99bc41286bd1cafb89a6b34f964b1c54948928fa498bacb2b.exe 82 PID 4608 wrote to memory of 228 4608 df5723e1c7644fc99bc41286bd1cafb89a6b34f964b1c54948928fa498bacb2b.exe 82 PID 228 wrote to memory of 2944 228 7xrlxrl.exe 83 PID 228 wrote to memory of 2944 228 7xrlxrl.exe 83 PID 228 wrote to memory of 2944 228 7xrlxrl.exe 83 PID 2944 wrote to memory of 2388 2944 htnbth.exe 84 PID 2944 wrote to memory of 2388 2944 htnbth.exe 84 PID 2944 wrote to memory of 2388 2944 htnbth.exe 84 PID 2388 wrote to memory of 4168 2388 fxrlxrl.exe 85 PID 2388 wrote to memory of 4168 2388 fxrlxrl.exe 85 PID 2388 wrote to memory of 4168 2388 fxrlxrl.exe 85 PID 4168 wrote to memory of 1944 4168 1ttnbb.exe 86 PID 4168 wrote to memory of 1944 4168 1ttnbb.exe 86 PID 4168 wrote to memory of 1944 4168 1ttnbb.exe 86 PID 1944 wrote to memory of 2248 1944 pjjdd.exe 87 PID 1944 wrote to memory of 2248 1944 pjjdd.exe 87 PID 1944 wrote to memory of 2248 1944 pjjdd.exe 87 PID 2248 wrote to memory of 624 2248 tnhbnn.exe 88 PID 2248 wrote to memory of 624 2248 tnhbnn.exe 88 PID 2248 wrote to memory of 624 2248 tnhbnn.exe 88 PID 624 wrote to memory of 3496 624 jppvj.exe 89 PID 624 wrote to memory of 3496 624 jppvj.exe 89 PID 624 wrote to memory of 3496 624 jppvj.exe 89 PID 3496 wrote to memory of 968 3496 htbhnt.exe 90 PID 3496 wrote to memory of 968 3496 htbhnt.exe 90 PID 3496 wrote to memory of 968 3496 htbhnt.exe 90 PID 968 wrote to memory of 1144 968 dpjpd.exe 91 PID 968 wrote to memory of 1144 968 dpjpd.exe 91 PID 968 wrote to memory of 1144 968 dpjpd.exe 91 PID 1144 wrote to memory of 1084 1144 xxxrlfx.exe 92 PID 1144 wrote to memory of 1084 1144 xxxrlfx.exe 92 PID 1144 wrote to memory of 1084 1144 xxxrlfx.exe 92 PID 1084 wrote to memory of 1456 1084 pvvjj.exe 93 PID 1084 wrote to memory of 1456 1084 pvvjj.exe 93 PID 1084 wrote to memory of 1456 1084 pvvjj.exe 93 PID 1456 wrote to memory of 3344 1456 xrfrrll.exe 94 PID 1456 wrote to memory of 3344 1456 xrfrrll.exe 94 PID 1456 wrote to memory of 3344 1456 xrfrrll.exe 94 PID 3344 wrote to memory of 3132 3344 tttnbt.exe 95 PID 3344 wrote to memory of 3132 3344 tttnbt.exe 95 PID 3344 wrote to memory of 3132 3344 tttnbt.exe 95 PID 3132 wrote to memory of 1620 3132 pdpdp.exe 96 PID 3132 wrote to memory of 1620 3132 pdpdp.exe 96 PID 3132 wrote to memory of 1620 3132 pdpdp.exe 96 PID 1620 wrote to memory of 2208 1620 3fxxrlf.exe 97 PID 1620 wrote to memory of 2208 1620 3fxxrlf.exe 97 PID 1620 wrote to memory of 2208 1620 3fxxrlf.exe 97 PID 2208 wrote to memory of 3272 2208 vddpj.exe 98 PID 2208 wrote to memory of 3272 2208 vddpj.exe 98 PID 2208 wrote to memory of 3272 2208 vddpj.exe 98 PID 3272 wrote to memory of 3252 3272 3jpjv.exe 99 PID 3272 wrote to memory of 3252 3272 3jpjv.exe 99 PID 3272 wrote to memory of 3252 3272 3jpjv.exe 99 PID 3252 wrote to memory of 2468 3252 9xxxllf.exe 100 PID 3252 wrote to memory of 2468 3252 9xxxllf.exe 100 PID 3252 wrote to memory of 2468 3252 9xxxllf.exe 100 PID 2468 wrote to memory of 4836 2468 1vdpd.exe 101 PID 2468 wrote to memory of 4836 2468 1vdpd.exe 101 PID 2468 wrote to memory of 4836 2468 1vdpd.exe 101 PID 4836 wrote to memory of 4416 4836 lrxlxxl.exe 102 PID 4836 wrote to memory of 4416 4836 lrxlxxl.exe 102 PID 4836 wrote to memory of 4416 4836 lrxlxxl.exe 102 PID 4416 wrote to memory of 684 4416 nbbnbt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\df5723e1c7644fc99bc41286bd1cafb89a6b34f964b1c54948928fa498bacb2b.exe"C:\Users\Admin\AppData\Local\Temp\df5723e1c7644fc99bc41286bd1cafb89a6b34f964b1c54948928fa498bacb2b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\7xrlxrl.exec:\7xrlxrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\htnbth.exec:\htnbth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\fxrlxrl.exec:\fxrlxrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\1ttnbb.exec:\1ttnbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\pjjdd.exec:\pjjdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\tnhbnn.exec:\tnhbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\jppvj.exec:\jppvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\htbhnt.exec:\htbhnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\dpjpd.exec:\dpjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\xxxrlfx.exec:\xxxrlfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\pvvjj.exec:\pvvjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\xrfrrll.exec:\xrfrrll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\tttnbt.exec:\tttnbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\pdpdp.exec:\pdpdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\3fxxrlf.exec:\3fxxrlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\vddpj.exec:\vddpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\3jpjv.exec:\3jpjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\9xxxllf.exec:\9xxxllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\1vdpd.exec:\1vdpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\lrxlxxl.exec:\lrxlxxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\nbbnbt.exec:\nbbnbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\pddvp.exec:\pddvp.exe23⤵
- Executes dropped EXE
PID:684 -
\??\c:\lflllff.exec:\lflllff.exe24⤵
- Executes dropped EXE
PID:4308 -
\??\c:\hnnhtn.exec:\hnnhtn.exe25⤵
- Executes dropped EXE
PID:4144 -
\??\c:\frffrrr.exec:\frffrrr.exe26⤵
- Executes dropped EXE
PID:5008 -
\??\c:\ntnbtn.exec:\ntnbtn.exe27⤵
- Executes dropped EXE
PID:3128 -
\??\c:\hbhthb.exec:\hbhthb.exe28⤵
- Executes dropped EXE
PID:3384 -
\??\c:\jddpj.exec:\jddpj.exe29⤵
- Executes dropped EXE
PID:2096 -
\??\c:\bhbnbt.exec:\bhbnbt.exe30⤵
- Executes dropped EXE
PID:3056 -
\??\c:\bnbnhb.exec:\bnbnhb.exe31⤵
- Executes dropped EXE
PID:1428 -
\??\c:\3dvpv.exec:\3dvpv.exe32⤵
- Executes dropped EXE
PID:5064 -
\??\c:\rlllxrf.exec:\rlllxrf.exe33⤵
- Executes dropped EXE
PID:4984 -
\??\c:\7hhtnh.exec:\7hhtnh.exe34⤵
- Executes dropped EXE
PID:920 -
\??\c:\jvpjd.exec:\jvpjd.exe35⤵
- Executes dropped EXE
PID:1012 -
\??\c:\lrxrxrf.exec:\lrxrxrf.exe36⤵
- Executes dropped EXE
PID:2260 -
\??\c:\btnnhb.exec:\btnnhb.exe37⤵
- Executes dropped EXE
PID:4044 -
\??\c:\jjppp.exec:\jjppp.exe38⤵
- Executes dropped EXE
PID:2988 -
\??\c:\9ffxrlf.exec:\9ffxrlf.exe39⤵
- Executes dropped EXE
PID:1052 -
\??\c:\pdpjv.exec:\pdpjv.exe40⤵
- Executes dropped EXE
PID:4304 -
\??\c:\vjdvj.exec:\vjdvj.exe41⤵
- Executes dropped EXE
PID:5076 -
\??\c:\rrrlfxl.exec:\rrrlfxl.exe42⤵
- Executes dropped EXE
PID:5092 -
\??\c:\hntnhh.exec:\hntnhh.exe43⤵
- Executes dropped EXE
PID:4832 -
\??\c:\hbbthb.exec:\hbbthb.exe44⤵
- Executes dropped EXE
PID:112 -
\??\c:\rrrlxxr.exec:\rrrlxxr.exe45⤵
- Executes dropped EXE
PID:2056 -
\??\c:\hhbhbn.exec:\hhbhbn.exe46⤵
- Executes dropped EXE
PID:4584 -
\??\c:\jddvp.exec:\jddvp.exe47⤵
- Executes dropped EXE
PID:1504 -
\??\c:\lffxlfx.exec:\lffxlfx.exe48⤵
- Executes dropped EXE
PID:1672 -
\??\c:\rfffxxx.exec:\rfffxxx.exe49⤵
- Executes dropped EXE
PID:1732 -
\??\c:\tbbthb.exec:\tbbthb.exe50⤵
- Executes dropped EXE
PID:1864 -
\??\c:\dvddp.exec:\dvddp.exe51⤵
- Executes dropped EXE
PID:1136 -
\??\c:\fffxxrr.exec:\fffxxrr.exe52⤵
- Executes dropped EXE
PID:4404 -
\??\c:\xrrlxrx.exec:\xrrlxrx.exe53⤵
- Executes dropped EXE
PID:2052 -
\??\c:\hhttbb.exec:\hhttbb.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4608 -
\??\c:\dvpjv.exec:\dvpjv.exe55⤵
- Executes dropped EXE
PID:4516 -
\??\c:\lrrlxrl.exec:\lrrlxrl.exe56⤵
- Executes dropped EXE
PID:5112 -
\??\c:\lllxrrl.exec:\lllxrrl.exe57⤵
- Executes dropped EXE
PID:664 -
\??\c:\jjpvp.exec:\jjpvp.exe58⤵
- Executes dropped EXE
PID:3752 -
\??\c:\7frflxx.exec:\7frflxx.exe59⤵
- Executes dropped EXE
PID:3536 -
\??\c:\frlxlfr.exec:\frlxlfr.exe60⤵
- Executes dropped EXE
PID:820 -
\??\c:\hnthhn.exec:\hnthhn.exe61⤵
- Executes dropped EXE
PID:1300 -
\??\c:\hnhtbn.exec:\hnhtbn.exe62⤵
- Executes dropped EXE
PID:2948 -
\??\c:\pddvv.exec:\pddvv.exe63⤵
- Executes dropped EXE
PID:3372 -
\??\c:\rrfrxrr.exec:\rrfrxrr.exe64⤵
- Executes dropped EXE
PID:1560 -
\??\c:\xffrxlx.exec:\xffrxlx.exe65⤵
- Executes dropped EXE
PID:752 -
\??\c:\bttnbt.exec:\bttnbt.exe66⤵PID:2552
-
\??\c:\dpjvp.exec:\dpjvp.exe67⤵PID:1636
-
\??\c:\rxfrllf.exec:\rxfrllf.exe68⤵PID:4448
-
\??\c:\nhbthh.exec:\nhbthh.exe69⤵PID:4364
-
\??\c:\tbhtbt.exec:\tbhtbt.exe70⤵PID:1292
-
\??\c:\5vpdv.exec:\5vpdv.exe71⤵PID:3200
-
\??\c:\pvpjv.exec:\pvpjv.exe72⤵PID:4708
-
\??\c:\xlrlffx.exec:\xlrlffx.exe73⤵PID:3360
-
\??\c:\fxfxrlf.exec:\fxfxrlf.exe74⤵PID:2916
-
\??\c:\nbthtt.exec:\nbthtt.exe75⤵PID:1720
-
\??\c:\5vjdp.exec:\5vjdp.exe76⤵PID:1484
-
\??\c:\lflrlxl.exec:\lflrlxl.exe77⤵PID:4436
-
\??\c:\1hhtnh.exec:\1hhtnh.exe78⤵PID:4200
-
\??\c:\hntnnh.exec:\hntnnh.exe79⤵PID:4928
-
\??\c:\pdjvp.exec:\pdjvp.exe80⤵PID:3488
-
\??\c:\frlfrxr.exec:\frlfrxr.exe81⤵PID:1920
-
\??\c:\tnbnnh.exec:\tnbnnh.exe82⤵PID:876
-
\??\c:\5tnhbt.exec:\5tnhbt.exe83⤵PID:1128
-
\??\c:\pvvpp.exec:\pvvpp.exe84⤵PID:4320
-
\??\c:\7ffllrr.exec:\7ffllrr.exe85⤵PID:2028
-
\??\c:\ttnthb.exec:\ttnthb.exe86⤵PID:4476
-
\??\c:\5nnbhn.exec:\5nnbhn.exe87⤵PID:964
-
\??\c:\pdvjv.exec:\pdvjv.exe88⤵PID:4920
-
\??\c:\9fxfrrf.exec:\9fxfrrf.exe89⤵PID:3928
-
\??\c:\9ffxllx.exec:\9ffxllx.exe90⤵PID:588
-
\??\c:\btbnnh.exec:\btbnnh.exe91⤵PID:3944
-
\??\c:\htnbnh.exec:\htnbnh.exe92⤵PID:4656
-
\??\c:\djpdp.exec:\djpdp.exe93⤵PID:1112
-
\??\c:\lfffflr.exec:\lfffflr.exe94⤵PID:4636
-
\??\c:\tbbnbt.exec:\tbbnbt.exe95⤵PID:4592
-
\??\c:\tnhbnt.exec:\tnhbnt.exe96⤵
- System Location Discovery: System Language Discovery
PID:456 -
\??\c:\vjppj.exec:\vjppj.exe97⤵PID:2428
-
\??\c:\rlflxlf.exec:\rlflxlf.exe98⤵PID:1488
-
\??\c:\frxllff.exec:\frxllff.exe99⤵PID:4628
-
\??\c:\nnnnhh.exec:\nnnnhh.exe100⤵PID:1304
-
\??\c:\vdjdp.exec:\vdjdp.exe101⤵PID:2168
-
\??\c:\xrrlfrl.exec:\xrrlfrl.exe102⤵PID:1728
-
\??\c:\rfrlxrr.exec:\rfrlxrr.exe103⤵PID:1668
-
\??\c:\1bhbth.exec:\1bhbth.exe104⤵PID:3792
-
\??\c:\pjdvj.exec:\pjdvj.exe105⤵PID:3172
-
\??\c:\jvvjd.exec:\jvvjd.exe106⤵PID:2256
-
\??\c:\fxfrrlx.exec:\fxfrrlx.exe107⤵PID:2004
-
\??\c:\xffxlfr.exec:\xffxlfr.exe108⤵PID:1076
-
\??\c:\htthbb.exec:\htthbb.exe109⤵PID:3336
-
\??\c:\3djdv.exec:\3djdv.exe110⤵PID:112
-
\??\c:\lfffrxr.exec:\lfffrxr.exe111⤵PID:3996
-
\??\c:\xrrrlrx.exec:\xrrrlrx.exe112⤵PID:4140
-
\??\c:\7nnnhb.exec:\7nnnhb.exe113⤵PID:2072
-
\??\c:\jpddv.exec:\jpddv.exe114⤵PID:692
-
\??\c:\3jvjv.exec:\3jvjv.exe115⤵PID:4488
-
\??\c:\3llxrrf.exec:\3llxrrf.exe116⤵PID:1564
-
\??\c:\hnnhbt.exec:\hnnhbt.exe117⤵PID:4388
-
\??\c:\jvvpv.exec:\jvvpv.exe118⤵PID:4396
-
\??\c:\rllfrlx.exec:\rllfrlx.exe119⤵PID:3156
-
\??\c:\rxfrfxl.exec:\rxfrfxl.exe120⤵PID:528
-
\??\c:\7tbbtt.exec:\7tbbtt.exe121⤵PID:2924
-
\??\c:\5jdpd.exec:\5jdpd.exe122⤵PID:5060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-