Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 18:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dbf9b57a3380e5d99d8c0c4247805f02052274f70d76117696cc85322b0392dbN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
dbf9b57a3380e5d99d8c0c4247805f02052274f70d76117696cc85322b0392dbN.exe
-
Size
456KB
-
MD5
a0fefd8e7c11a9c2882b6d5c3e71d2b0
-
SHA1
4f0f082365e513624c3ad3ac8f85cb1cf9e8940d
-
SHA256
dbf9b57a3380e5d99d8c0c4247805f02052274f70d76117696cc85322b0392db
-
SHA512
d19b343eff80ce98df73cd5260931791224f20f612e884fb6a1130d355dd2e16bf9f0543c83c259d6d559e2e4fda26527f72068b2f398486a2ed4db00dc32c0c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRk:q7Tc2NYHUrAwfMp3CDRk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral2/memory/4468-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2100-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/776-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3180-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2292-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1008-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1680-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3376-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1572-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1748-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1128-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-743-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-813-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1680-863-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-876-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-968-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2084-1053-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3860-1371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3232 lxrrrfx.exe 2356 1hnntt.exe 2100 bbtnht.exe 2360 1bttbh.exe 1168 lrrfrxx.exe 4396 jjjpp.exe 1204 hbhhhh.exe 1580 flxxxfx.exe 4488 5pvvv.exe 1592 3xxlxlx.exe 4764 tbhhbh.exe 5056 lflxxlf.exe 4152 nbnhbb.exe 4148 tbnhbb.exe 224 pjpdv.exe 3152 xfrllrx.exe 4616 5vvvv.exe 776 1jppv.exe 1112 hnbbbt.exe 3180 nttbbh.exe 4892 pvppp.exe 3408 xxfllll.exe 1820 flrlllf.exe 2292 lxxlffx.exe 2600 ffxxxxx.exe 1152 jjppv.exe 4988 7nhhbb.exe 4976 nntnnn.exe 4664 dvjjj.exe 3744 lrffrrl.exe 1008 xrxxxff.exe 2016 tthnnb.exe 220 pjddv.exe 1124 5ntttb.exe 2696 ddppp.exe 3824 ffffllr.exe 2968 flllllf.exe 3952 bbhhbb.exe 1460 vvddp.exe 4700 lfxrrrr.exe 2308 ttttnt.exe 2088 3dvvp.exe 772 lrrrrxx.exe 672 5vdjj.exe 4100 fxfflrr.exe 4800 bhnnnn.exe 2856 djpjj.exe 4380 fffffll.exe 1680 bhhhbb.exe 3148 9vvvv.exe 2432 xxlffxx.exe 4120 btbnht.exe 3184 dppvd.exe 3492 jjppp.exe 1928 xxfxxrr.exe 5092 tnttnt.exe 2900 5vppj.exe 2100 9hhhhh.exe 3340 btthnb.exe 4052 jdjjj.exe 840 3llllrr.exe 3104 rrrrrrr.exe 1432 1hnhbh.exe 1452 vjpdj.exe -
resource yara_rule behavioral2/memory/4468-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2100-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/776-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3180-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1152-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1124-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1680-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4120-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3104-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3376-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1572-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1748-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1128-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-813-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1680-863-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-876-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-968-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-1053-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4468 wrote to memory of 3232 4468 dbf9b57a3380e5d99d8c0c4247805f02052274f70d76117696cc85322b0392dbN.exe 83 PID 4468 wrote to memory of 3232 4468 dbf9b57a3380e5d99d8c0c4247805f02052274f70d76117696cc85322b0392dbN.exe 83 PID 4468 wrote to memory of 3232 4468 dbf9b57a3380e5d99d8c0c4247805f02052274f70d76117696cc85322b0392dbN.exe 83 PID 3232 wrote to memory of 2356 3232 lxrrrfx.exe 84 PID 3232 wrote to memory of 2356 3232 lxrrrfx.exe 84 PID 3232 wrote to memory of 2356 3232 lxrrrfx.exe 84 PID 2356 wrote to memory of 2100 2356 1hnntt.exe 85 PID 2356 wrote to memory of 2100 2356 1hnntt.exe 85 PID 2356 wrote to memory of 2100 2356 1hnntt.exe 85 PID 2100 wrote to memory of 2360 2100 bbtnht.exe 86 PID 2100 wrote to memory of 2360 2100 bbtnht.exe 86 PID 2100 wrote to memory of 2360 2100 bbtnht.exe 86 PID 2360 wrote to memory of 1168 2360 1bttbh.exe 87 PID 2360 wrote to memory of 1168 2360 1bttbh.exe 87 PID 2360 wrote to memory of 1168 2360 1bttbh.exe 87 PID 1168 wrote to memory of 4396 1168 lrrfrxx.exe 88 PID 1168 wrote to memory of 4396 1168 lrrfrxx.exe 88 PID 1168 wrote to memory of 4396 1168 lrrfrxx.exe 88 PID 4396 wrote to memory of 1204 4396 jjjpp.exe 89 PID 4396 wrote to memory of 1204 4396 jjjpp.exe 89 PID 4396 wrote to memory of 1204 4396 jjjpp.exe 89 PID 1204 wrote to memory of 1580 1204 hbhhhh.exe 90 PID 1204 wrote to memory of 1580 1204 hbhhhh.exe 90 PID 1204 wrote to memory of 1580 1204 hbhhhh.exe 90 PID 1580 wrote to memory of 4488 1580 flxxxfx.exe 91 PID 1580 wrote to memory of 4488 1580 flxxxfx.exe 91 PID 1580 wrote to memory of 4488 1580 flxxxfx.exe 91 PID 4488 wrote to memory of 1592 4488 5pvvv.exe 92 PID 4488 wrote to memory of 1592 4488 5pvvv.exe 92 PID 4488 wrote to memory of 1592 4488 5pvvv.exe 92 PID 1592 wrote to memory of 4764 1592 3xxlxlx.exe 93 PID 1592 wrote to memory of 4764 1592 3xxlxlx.exe 93 PID 1592 wrote to memory of 4764 1592 3xxlxlx.exe 93 PID 4764 wrote to memory of 5056 4764 tbhhbh.exe 94 PID 4764 wrote to memory of 5056 4764 tbhhbh.exe 94 PID 4764 wrote to memory of 5056 4764 tbhhbh.exe 94 PID 5056 wrote to memory of 4152 5056 lflxxlf.exe 95 PID 5056 wrote to memory of 4152 5056 lflxxlf.exe 95 PID 5056 wrote to memory of 4152 5056 lflxxlf.exe 95 PID 4152 wrote to memory of 4148 4152 nbnhbb.exe 96 PID 4152 wrote to memory of 4148 4152 nbnhbb.exe 96 PID 4152 wrote to memory of 4148 4152 nbnhbb.exe 96 PID 4148 wrote to memory of 224 4148 tbnhbb.exe 97 PID 4148 wrote to memory of 224 4148 tbnhbb.exe 97 PID 4148 wrote to memory of 224 4148 tbnhbb.exe 97 PID 224 wrote to memory of 3152 224 pjpdv.exe 98 PID 224 wrote to memory of 3152 224 pjpdv.exe 98 PID 224 wrote to memory of 3152 224 pjpdv.exe 98 PID 3152 wrote to memory of 4616 3152 xfrllrx.exe 99 PID 3152 wrote to memory of 4616 3152 xfrllrx.exe 99 PID 3152 wrote to memory of 4616 3152 xfrllrx.exe 99 PID 4616 wrote to memory of 776 4616 5vvvv.exe 100 PID 4616 wrote to memory of 776 4616 5vvvv.exe 100 PID 4616 wrote to memory of 776 4616 5vvvv.exe 100 PID 776 wrote to memory of 1112 776 1jppv.exe 101 PID 776 wrote to memory of 1112 776 1jppv.exe 101 PID 776 wrote to memory of 1112 776 1jppv.exe 101 PID 1112 wrote to memory of 3180 1112 hnbbbt.exe 102 PID 1112 wrote to memory of 3180 1112 hnbbbt.exe 102 PID 1112 wrote to memory of 3180 1112 hnbbbt.exe 102 PID 3180 wrote to memory of 4892 3180 nttbbh.exe 103 PID 3180 wrote to memory of 4892 3180 nttbbh.exe 103 PID 3180 wrote to memory of 4892 3180 nttbbh.exe 103 PID 4892 wrote to memory of 3408 4892 pvppp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbf9b57a3380e5d99d8c0c4247805f02052274f70d76117696cc85322b0392dbN.exe"C:\Users\Admin\AppData\Local\Temp\dbf9b57a3380e5d99d8c0c4247805f02052274f70d76117696cc85322b0392dbN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\lxrrrfx.exec:\lxrrrfx.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\1hnntt.exec:\1hnntt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\bbtnht.exec:\bbtnht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\1bttbh.exec:\1bttbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\lrrfrxx.exec:\lrrfrxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\jjjpp.exec:\jjjpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\hbhhhh.exec:\hbhhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\flxxxfx.exec:\flxxxfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\5pvvv.exec:\5pvvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\3xxlxlx.exec:\3xxlxlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\tbhhbh.exec:\tbhhbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\lflxxlf.exec:\lflxxlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\nbnhbb.exec:\nbnhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\tbnhbb.exec:\tbnhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\pjpdv.exec:\pjpdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\xfrllrx.exec:\xfrllrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\5vvvv.exec:\5vvvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\1jppv.exec:\1jppv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\hnbbbt.exec:\hnbbbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\nttbbh.exec:\nttbbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\pvppp.exec:\pvppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\xxfllll.exec:\xxfllll.exe23⤵
- Executes dropped EXE
PID:3408 -
\??\c:\flrlllf.exec:\flrlllf.exe24⤵
- Executes dropped EXE
PID:1820 -
\??\c:\lxxlffx.exec:\lxxlffx.exe25⤵
- Executes dropped EXE
PID:2292 -
\??\c:\ffxxxxx.exec:\ffxxxxx.exe26⤵
- Executes dropped EXE
PID:2600 -
\??\c:\jjppv.exec:\jjppv.exe27⤵
- Executes dropped EXE
PID:1152 -
\??\c:\7nhhbb.exec:\7nhhbb.exe28⤵
- Executes dropped EXE
PID:4988 -
\??\c:\nntnnn.exec:\nntnnn.exe29⤵
- Executes dropped EXE
PID:4976 -
\??\c:\dvjjj.exec:\dvjjj.exe30⤵
- Executes dropped EXE
PID:4664 -
\??\c:\lrffrrl.exec:\lrffrrl.exe31⤵
- Executes dropped EXE
PID:3744 -
\??\c:\xrxxxff.exec:\xrxxxff.exe32⤵
- Executes dropped EXE
PID:1008 -
\??\c:\tthnnb.exec:\tthnnb.exe33⤵
- Executes dropped EXE
PID:2016 -
\??\c:\pjddv.exec:\pjddv.exe34⤵
- Executes dropped EXE
PID:220 -
\??\c:\5ntttb.exec:\5ntttb.exe35⤵
- Executes dropped EXE
PID:1124 -
\??\c:\ddppp.exec:\ddppp.exe36⤵
- Executes dropped EXE
PID:2696 -
\??\c:\ffffllr.exec:\ffffllr.exe37⤵
- Executes dropped EXE
PID:3824 -
\??\c:\flllllf.exec:\flllllf.exe38⤵
- Executes dropped EXE
PID:2968 -
\??\c:\bbhhbb.exec:\bbhhbb.exe39⤵
- Executes dropped EXE
PID:3952 -
\??\c:\vvddp.exec:\vvddp.exe40⤵
- Executes dropped EXE
PID:1460 -
\??\c:\lfxrrrr.exec:\lfxrrrr.exe41⤵
- Executes dropped EXE
PID:4700 -
\??\c:\ttttnt.exec:\ttttnt.exe42⤵
- Executes dropped EXE
PID:2308 -
\??\c:\3dvvp.exec:\3dvvp.exe43⤵
- Executes dropped EXE
PID:2088 -
\??\c:\lrrrrxx.exec:\lrrrrxx.exe44⤵
- Executes dropped EXE
PID:772 -
\??\c:\5vdjj.exec:\5vdjj.exe45⤵
- Executes dropped EXE
PID:672 -
\??\c:\fxfflrr.exec:\fxfflrr.exe46⤵
- Executes dropped EXE
PID:4100 -
\??\c:\bhnnnn.exec:\bhnnnn.exe47⤵
- Executes dropped EXE
PID:4800 -
\??\c:\djpjj.exec:\djpjj.exe48⤵
- Executes dropped EXE
PID:2856 -
\??\c:\fffffll.exec:\fffffll.exe49⤵
- Executes dropped EXE
PID:4380 -
\??\c:\bhhhbb.exec:\bhhhbb.exe50⤵
- Executes dropped EXE
PID:1680 -
\??\c:\9vvvv.exec:\9vvvv.exe51⤵
- Executes dropped EXE
PID:3148 -
\??\c:\xxlffxx.exec:\xxlffxx.exe52⤵
- Executes dropped EXE
PID:2432 -
\??\c:\btbnht.exec:\btbnht.exe53⤵
- Executes dropped EXE
PID:4120 -
\??\c:\dppvd.exec:\dppvd.exe54⤵
- Executes dropped EXE
PID:3184 -
\??\c:\jjppp.exec:\jjppp.exe55⤵
- Executes dropped EXE
PID:3492 -
\??\c:\xxfxxrr.exec:\xxfxxrr.exe56⤵
- Executes dropped EXE
PID:1928 -
\??\c:\tnttnt.exec:\tnttnt.exe57⤵
- Executes dropped EXE
PID:5092 -
\??\c:\5vppj.exec:\5vppj.exe58⤵
- Executes dropped EXE
PID:2900 -
\??\c:\9hhhhh.exec:\9hhhhh.exe59⤵
- Executes dropped EXE
PID:2100 -
\??\c:\btthnb.exec:\btthnb.exe60⤵
- Executes dropped EXE
PID:3340 -
\??\c:\jdjjj.exec:\jdjjj.exe61⤵
- Executes dropped EXE
PID:4052 -
\??\c:\3llllrr.exec:\3llllrr.exe62⤵
- Executes dropped EXE
PID:840 -
\??\c:\rrrrrrr.exec:\rrrrrrr.exe63⤵
- Executes dropped EXE
PID:3104 -
\??\c:\1hnhbh.exec:\1hnhbh.exe64⤵
- Executes dropped EXE
PID:1432 -
\??\c:\vjpdj.exec:\vjpdj.exe65⤵
- Executes dropped EXE
PID:1452 -
\??\c:\rfllxfl.exec:\rfllxfl.exe66⤵PID:1000
-
\??\c:\hhhhtb.exec:\hhhhtb.exe67⤵PID:1580
-
\??\c:\3djdv.exec:\3djdv.exe68⤵PID:3648
-
\??\c:\fxffrlr.exec:\fxffrlr.exe69⤵PID:4676
-
\??\c:\lxfxrxr.exec:\lxfxrxr.exe70⤵PID:3576
-
\??\c:\tbtbhn.exec:\tbtbhn.exe71⤵PID:8
-
\??\c:\pddvv.exec:\pddvv.exe72⤵PID:1984
-
\??\c:\rxxxxfx.exec:\rxxxxfx.exe73⤵PID:3888
-
\??\c:\lrxxfrx.exec:\lrxxfrx.exe74⤵PID:4148
-
\??\c:\ttnnnt.exec:\ttnnnt.exe75⤵PID:3364
-
\??\c:\pvpjv.exec:\pvpjv.exe76⤵PID:764
-
\??\c:\xflllrl.exec:\xflllrl.exe77⤵PID:2808
-
\??\c:\lrrxrfx.exec:\lrrxrfx.exe78⤵PID:3048
-
\??\c:\nntbbh.exec:\nntbbh.exe79⤵PID:3516
-
\??\c:\dvddd.exec:\dvddd.exe80⤵PID:1892
-
\??\c:\pvdjj.exec:\pvdjj.exe81⤵PID:4376
-
\??\c:\rxrfxrx.exec:\rxrfxrx.exe82⤵PID:4756
-
\??\c:\hbnhhn.exec:\hbnhhn.exe83⤵PID:4892
-
\??\c:\pvddj.exec:\pvddj.exe84⤵PID:3852
-
\??\c:\5pddv.exec:\5pddv.exe85⤵PID:3620
-
\??\c:\lfxxrrl.exec:\lfxxrrl.exe86⤵PID:2632
-
\??\c:\nnnhhh.exec:\nnnhhh.exe87⤵PID:3376
-
\??\c:\5dddd.exec:\5dddd.exe88⤵PID:928
-
\??\c:\fxffrrl.exec:\fxffrrl.exe89⤵PID:4528
-
\??\c:\lrrlllf.exec:\lrrlllf.exe90⤵PID:2920
-
\??\c:\ntbttb.exec:\ntbttb.exe91⤵PID:2108
-
\??\c:\pjvdv.exec:\pjvdv.exe92⤵PID:1292
-
\??\c:\rrrxrxl.exec:\rrrxrxl.exe93⤵PID:5012
-
\??\c:\nhhbtn.exec:\nhhbtn.exe94⤵PID:4612
-
\??\c:\dpvpj.exec:\dpvpj.exe95⤵PID:4216
-
\??\c:\fflfxxx.exec:\fflfxxx.exe96⤵PID:2160
-
\??\c:\btnbnh.exec:\btnbnh.exe97⤵PID:1880
-
\??\c:\1pddd.exec:\1pddd.exe98⤵PID:4424
-
\??\c:\5ffflrr.exec:\5ffflrr.exe99⤵PID:4060
-
\??\c:\tbbbbb.exec:\tbbbbb.exe100⤵PID:2024
-
\??\c:\pdjvd.exec:\pdjvd.exe101⤵PID:1636
-
\??\c:\lrxfrrr.exec:\lrxfrrr.exe102⤵PID:2968
-
\??\c:\nntbbb.exec:\nntbbb.exe103⤵PID:2140
-
\??\c:\nntttb.exec:\nntttb.exe104⤵PID:4432
-
\??\c:\1vdvp.exec:\1vdvp.exe105⤵PID:3960
-
\??\c:\lrxrffl.exec:\lrxrffl.exe106⤵PID:3008
-
\??\c:\httttt.exec:\httttt.exe107⤵PID:1572
-
\??\c:\1jddd.exec:\1jddd.exe108⤵PID:3448
-
\??\c:\lxlrxfx.exec:\lxlrxfx.exe109⤵PID:4580
-
\??\c:\ffrffff.exec:\ffrffff.exe110⤵PID:3240
-
\??\c:\nhbbhh.exec:\nhbbhh.exe111⤵PID:1060
-
\??\c:\jjjdd.exec:\jjjdd.exe112⤵PID:3936
-
\??\c:\9rfrrrl.exec:\9rfrrrl.exe113⤵PID:4776
-
\??\c:\bhbbtn.exec:\bhbbtn.exe114⤵PID:1536
-
\??\c:\vjvvv.exec:\vjvvv.exe115⤵PID:3016
-
\??\c:\3fllflf.exec:\3fllflf.exe116⤵PID:4460
-
\??\c:\fxlxxxl.exec:\fxlxxxl.exe117⤵PID:4120
-
\??\c:\tbbbtt.exec:\tbbbtt.exe118⤵PID:3288
-
\??\c:\vvvjj.exec:\vvvjj.exe119⤵PID:3060
-
\??\c:\flrrrrr.exec:\flrrrrr.exe120⤵PID:516
-
\??\c:\nthhht.exec:\nthhht.exe121⤵PID:1160
-
\??\c:\hnttnt.exec:\hnttnt.exe122⤵PID:4032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-