Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 18:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
96c8dbfcf4811b5f5bfbe4e63afbe4b80f752239f254c587ed39fd82c4eb1e65N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
96c8dbfcf4811b5f5bfbe4e63afbe4b80f752239f254c587ed39fd82c4eb1e65N.exe
-
Size
455KB
-
MD5
c9ebf64fc48eba5d0588635df2f98d30
-
SHA1
98bb7df5d404306e70330dd164a3744d3c35db5b
-
SHA256
96c8dbfcf4811b5f5bfbe4e63afbe4b80f752239f254c587ed39fd82c4eb1e65
-
SHA512
39caaf215d25d5598360819572cc2139932831860a508658860f9c52045e1bc4ea1172789509e917a2ee808ff982036749af19c9308fc7be76e9227acfc72c7d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe+Y:q7Tc2NYHUrAwfMp3CD+Y
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4476-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3360-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1516-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2276-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3876-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/820-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3836-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3824-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1072-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2856-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1516-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1012-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/660-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2620-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3824-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1072-670-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1748-755-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-1083-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-1306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2232 1bhbhn.exe 3360 xlffxxx.exe 376 5hbttt.exe 3624 rffffff.exe 3872 vddvv.exe 3644 nnttnn.exe 1516 5ffxrll.exe 2276 vppdp.exe 4320 nbhhtn.exe 2928 bntnnn.exe 1988 ttttbb.exe 2992 jjvvj.exe 664 xrrlfxr.exe 3876 tthbbn.exe 3936 pdpvv.exe 4464 7rxrllf.exe 3112 pvvpj.exe 4292 3nhhbn.exe 2724 vjdpp.exe 2728 5tbbbb.exe 228 1bhbnh.exe 5036 vjdjp.exe 4304 rfffxfx.exe 2944 rrfxxxr.exe 3436 bthhnh.exe 536 llfllrf.exe 2296 3jjdv.exe 1996 tnhbbh.exe 3716 rlrrlfx.exe 5044 1dvpd.exe 3248 rrxxffx.exe 968 tntbth.exe 1220 lxfxxxr.exe 4148 ttttnn.exe 1432 pjjdv.exe 820 3xxxfrr.exe 1948 tntnhh.exe 3836 dvjjd.exe 2060 lrrrxxr.exe 2560 hhnnnh.exe 3040 jjpjv.exe 3824 dpvvp.exe 3088 rflfrrr.exe 452 1ttnnt.exe 4800 dpvpp.exe 1812 lfllfff.exe 4020 1ttnnt.exe 4512 nhnhnn.exe 2736 pdpjd.exe 5088 3rrllll.exe 2868 ttbtnn.exe 4144 vjvpp.exe 4412 lrlllxr.exe 1164 bbnnnb.exe 1072 1bhbbb.exe 4680 dvjpp.exe 3456 lxlfxrr.exe 2508 nnnnbh.exe 3148 tbnhbb.exe 2520 jpddj.exe 1688 fxfxrlf.exe 1180 3tbbnn.exe 2856 dpvpp.exe 4180 vpdpp.exe -
resource yara_rule behavioral2/memory/4476-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3360-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1516-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2276-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3876-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/820-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3836-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3040-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3824-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1072-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2856-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1516-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/660-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2620-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3824-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4120-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-663-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4476 wrote to memory of 2232 4476 96c8dbfcf4811b5f5bfbe4e63afbe4b80f752239f254c587ed39fd82c4eb1e65N.exe 82 PID 4476 wrote to memory of 2232 4476 96c8dbfcf4811b5f5bfbe4e63afbe4b80f752239f254c587ed39fd82c4eb1e65N.exe 82 PID 4476 wrote to memory of 2232 4476 96c8dbfcf4811b5f5bfbe4e63afbe4b80f752239f254c587ed39fd82c4eb1e65N.exe 82 PID 2232 wrote to memory of 3360 2232 1bhbhn.exe 83 PID 2232 wrote to memory of 3360 2232 1bhbhn.exe 83 PID 2232 wrote to memory of 3360 2232 1bhbhn.exe 83 PID 3360 wrote to memory of 376 3360 xlffxxx.exe 84 PID 3360 wrote to memory of 376 3360 xlffxxx.exe 84 PID 3360 wrote to memory of 376 3360 xlffxxx.exe 84 PID 376 wrote to memory of 3624 376 5hbttt.exe 85 PID 376 wrote to memory of 3624 376 5hbttt.exe 85 PID 376 wrote to memory of 3624 376 5hbttt.exe 85 PID 3624 wrote to memory of 3872 3624 rffffff.exe 86 PID 3624 wrote to memory of 3872 3624 rffffff.exe 86 PID 3624 wrote to memory of 3872 3624 rffffff.exe 86 PID 3872 wrote to memory of 3644 3872 vddvv.exe 87 PID 3872 wrote to memory of 3644 3872 vddvv.exe 87 PID 3872 wrote to memory of 3644 3872 vddvv.exe 87 PID 3644 wrote to memory of 1516 3644 nnttnn.exe 88 PID 3644 wrote to memory of 1516 3644 nnttnn.exe 88 PID 3644 wrote to memory of 1516 3644 nnttnn.exe 88 PID 1516 wrote to memory of 2276 1516 5ffxrll.exe 89 PID 1516 wrote to memory of 2276 1516 5ffxrll.exe 89 PID 1516 wrote to memory of 2276 1516 5ffxrll.exe 89 PID 2276 wrote to memory of 4320 2276 vppdp.exe 90 PID 2276 wrote to memory of 4320 2276 vppdp.exe 90 PID 2276 wrote to memory of 4320 2276 vppdp.exe 90 PID 4320 wrote to memory of 2928 4320 nbhhtn.exe 91 PID 4320 wrote to memory of 2928 4320 nbhhtn.exe 91 PID 4320 wrote to memory of 2928 4320 nbhhtn.exe 91 PID 2928 wrote to memory of 1988 2928 bntnnn.exe 92 PID 2928 wrote to memory of 1988 2928 bntnnn.exe 92 PID 2928 wrote to memory of 1988 2928 bntnnn.exe 92 PID 1988 wrote to memory of 2992 1988 ttttbb.exe 93 PID 1988 wrote to memory of 2992 1988 ttttbb.exe 93 PID 1988 wrote to memory of 2992 1988 ttttbb.exe 93 PID 2992 wrote to memory of 664 2992 jjvvj.exe 94 PID 2992 wrote to memory of 664 2992 jjvvj.exe 94 PID 2992 wrote to memory of 664 2992 jjvvj.exe 94 PID 664 wrote to memory of 3876 664 xrrlfxr.exe 95 PID 664 wrote to memory of 3876 664 xrrlfxr.exe 95 PID 664 wrote to memory of 3876 664 xrrlfxr.exe 95 PID 3876 wrote to memory of 3936 3876 tthbbn.exe 96 PID 3876 wrote to memory of 3936 3876 tthbbn.exe 96 PID 3876 wrote to memory of 3936 3876 tthbbn.exe 96 PID 3936 wrote to memory of 4464 3936 pdpvv.exe 97 PID 3936 wrote to memory of 4464 3936 pdpvv.exe 97 PID 3936 wrote to memory of 4464 3936 pdpvv.exe 97 PID 4464 wrote to memory of 3112 4464 7rxrllf.exe 98 PID 4464 wrote to memory of 3112 4464 7rxrllf.exe 98 PID 4464 wrote to memory of 3112 4464 7rxrllf.exe 98 PID 3112 wrote to memory of 4292 3112 pvvpj.exe 99 PID 3112 wrote to memory of 4292 3112 pvvpj.exe 99 PID 3112 wrote to memory of 4292 3112 pvvpj.exe 99 PID 4292 wrote to memory of 2724 4292 3nhhbn.exe 100 PID 4292 wrote to memory of 2724 4292 3nhhbn.exe 100 PID 4292 wrote to memory of 2724 4292 3nhhbn.exe 100 PID 2724 wrote to memory of 2728 2724 vjdpp.exe 101 PID 2724 wrote to memory of 2728 2724 vjdpp.exe 101 PID 2724 wrote to memory of 2728 2724 vjdpp.exe 101 PID 2728 wrote to memory of 228 2728 5tbbbb.exe 102 PID 2728 wrote to memory of 228 2728 5tbbbb.exe 102 PID 2728 wrote to memory of 228 2728 5tbbbb.exe 102 PID 228 wrote to memory of 5036 228 1bhbnh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\96c8dbfcf4811b5f5bfbe4e63afbe4b80f752239f254c587ed39fd82c4eb1e65N.exe"C:\Users\Admin\AppData\Local\Temp\96c8dbfcf4811b5f5bfbe4e63afbe4b80f752239f254c587ed39fd82c4eb1e65N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\1bhbhn.exec:\1bhbhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\xlffxxx.exec:\xlffxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\5hbttt.exec:\5hbttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\rffffff.exec:\rffffff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\vddvv.exec:\vddvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\nnttnn.exec:\nnttnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\5ffxrll.exec:\5ffxrll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\vppdp.exec:\vppdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\nbhhtn.exec:\nbhhtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\bntnnn.exec:\bntnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\ttttbb.exec:\ttttbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\jjvvj.exec:\jjvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\tthbbn.exec:\tthbbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
\??\c:\pdpvv.exec:\pdpvv.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\7rxrllf.exec:\7rxrllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\pvvpj.exec:\pvvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\3nhhbn.exec:\3nhhbn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\vjdpp.exec:\vjdpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\5tbbbb.exec:\5tbbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\1bhbnh.exec:\1bhbnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\vjdjp.exec:\vjdjp.exe23⤵
- Executes dropped EXE
PID:5036 -
\??\c:\rfffxfx.exec:\rfffxfx.exe24⤵
- Executes dropped EXE
PID:4304 -
\??\c:\rrfxxxr.exec:\rrfxxxr.exe25⤵
- Executes dropped EXE
PID:2944 -
\??\c:\bthhnh.exec:\bthhnh.exe26⤵
- Executes dropped EXE
PID:3436 -
\??\c:\llfllrf.exec:\llfllrf.exe27⤵
- Executes dropped EXE
PID:536 -
\??\c:\3jjdv.exec:\3jjdv.exe28⤵
- Executes dropped EXE
PID:2296 -
\??\c:\tnhbbh.exec:\tnhbbh.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1996 -
\??\c:\rlrrlfx.exec:\rlrrlfx.exe30⤵
- Executes dropped EXE
PID:3716 -
\??\c:\1dvpd.exec:\1dvpd.exe31⤵
- Executes dropped EXE
PID:5044 -
\??\c:\rrxxffx.exec:\rrxxffx.exe32⤵
- Executes dropped EXE
PID:3248 -
\??\c:\tntbth.exec:\tntbth.exe33⤵
- Executes dropped EXE
PID:968 -
\??\c:\lxfxxxr.exec:\lxfxxxr.exe34⤵
- Executes dropped EXE
PID:1220 -
\??\c:\ttttnn.exec:\ttttnn.exe35⤵
- Executes dropped EXE
PID:4148 -
\??\c:\pjjdv.exec:\pjjdv.exe36⤵
- Executes dropped EXE
PID:1432 -
\??\c:\3xxxfrr.exec:\3xxxfrr.exe37⤵
- Executes dropped EXE
PID:820 -
\??\c:\tntnhh.exec:\tntnhh.exe38⤵
- Executes dropped EXE
PID:1948 -
\??\c:\dvjjd.exec:\dvjjd.exe39⤵
- Executes dropped EXE
PID:3836 -
\??\c:\lrrrxxr.exec:\lrrrxxr.exe40⤵
- Executes dropped EXE
PID:2060 -
\??\c:\hhnnnh.exec:\hhnnnh.exe41⤵
- Executes dropped EXE
PID:2560 -
\??\c:\jjpjv.exec:\jjpjv.exe42⤵
- Executes dropped EXE
PID:3040 -
\??\c:\dpvvp.exec:\dpvvp.exe43⤵
- Executes dropped EXE
PID:3824 -
\??\c:\rflfrrr.exec:\rflfrrr.exe44⤵
- Executes dropped EXE
PID:3088 -
\??\c:\1ttnnt.exec:\1ttnnt.exe45⤵
- Executes dropped EXE
PID:452 -
\??\c:\dpvpp.exec:\dpvpp.exe46⤵
- Executes dropped EXE
PID:4800 -
\??\c:\lfllfff.exec:\lfllfff.exe47⤵
- Executes dropped EXE
PID:1812 -
\??\c:\1ttnnt.exec:\1ttnnt.exe48⤵
- Executes dropped EXE
PID:4020 -
\??\c:\nhnhnn.exec:\nhnhnn.exe49⤵
- Executes dropped EXE
PID:4512 -
\??\c:\pdpjd.exec:\pdpjd.exe50⤵
- Executes dropped EXE
PID:2736 -
\??\c:\3rrllll.exec:\3rrllll.exe51⤵
- Executes dropped EXE
PID:5088 -
\??\c:\ttbtnn.exec:\ttbtnn.exe52⤵
- Executes dropped EXE
PID:2868 -
\??\c:\vjvpp.exec:\vjvpp.exe53⤵
- Executes dropped EXE
PID:4144 -
\??\c:\lrlllxr.exec:\lrlllxr.exe54⤵
- Executes dropped EXE
PID:4412 -
\??\c:\bbnnnb.exec:\bbnnnb.exe55⤵
- Executes dropped EXE
PID:1164 -
\??\c:\1bhbbb.exec:\1bhbbb.exe56⤵
- Executes dropped EXE
PID:1072 -
\??\c:\dvjpp.exec:\dvjpp.exe57⤵
- Executes dropped EXE
PID:4680 -
\??\c:\lxlfxrr.exec:\lxlfxrr.exe58⤵
- Executes dropped EXE
PID:3456 -
\??\c:\nnnnbh.exec:\nnnnbh.exe59⤵
- Executes dropped EXE
PID:2508 -
\??\c:\tbnhbb.exec:\tbnhbb.exe60⤵
- Executes dropped EXE
PID:3148 -
\??\c:\jpddj.exec:\jpddj.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2520 -
\??\c:\fxfxrlf.exec:\fxfxrlf.exe62⤵
- Executes dropped EXE
PID:1688 -
\??\c:\3tbbnn.exec:\3tbbnn.exe63⤵
- Executes dropped EXE
PID:1180 -
\??\c:\dpvpp.exec:\dpvpp.exe64⤵
- Executes dropped EXE
PID:2856 -
\??\c:\vpdpp.exec:\vpdpp.exe65⤵
- Executes dropped EXE
PID:4180 -
\??\c:\ttnhbb.exec:\ttnhbb.exe66⤵PID:1516
-
\??\c:\5pjdv.exec:\5pjdv.exe67⤵PID:2840
-
\??\c:\flllxxr.exec:\flllxxr.exe68⤵PID:4892
-
\??\c:\btttnn.exec:\btttnn.exe69⤵PID:4376
-
\??\c:\bhnnhn.exec:\bhnnhn.exe70⤵PID:4348
-
\??\c:\1jpjj.exec:\1jpjj.exe71⤵PID:4912
-
\??\c:\lxxxrxx.exec:\lxxxrxx.exe72⤵PID:4940
-
\??\c:\1bhbnn.exec:\1bhbnn.exe73⤵PID:3636
-
\??\c:\tnnhhh.exec:\tnnhhh.exe74⤵PID:1884
-
\??\c:\ddjjp.exec:\ddjjp.exe75⤵PID:4480
-
\??\c:\rlffxxx.exec:\rlffxxx.exe76⤵PID:3656
-
\??\c:\nnhbnn.exec:\nnhbnn.exe77⤵PID:4076
-
\??\c:\hntnhb.exec:\hntnhb.exe78⤵PID:2528
-
\??\c:\jddvd.exec:\jddvd.exe79⤵PID:3432
-
\??\c:\1bbbbn.exec:\1bbbbn.exe80⤵PID:3036
-
\??\c:\btbbbn.exec:\btbbbn.exe81⤵PID:4544
-
\??\c:\vdjdv.exec:\vdjdv.exe82⤵PID:856
-
\??\c:\7rfxflx.exec:\7rfxflx.exe83⤵PID:1012
-
\??\c:\3tttnt.exec:\3tttnt.exe84⤵PID:1264
-
\??\c:\5ppjj.exec:\5ppjj.exe85⤵PID:2040
-
\??\c:\3dvpj.exec:\3dvpj.exe86⤵PID:2168
-
\??\c:\9rfxxxx.exec:\9rfxxxx.exe87⤵PID:4156
-
\??\c:\1btttb.exec:\1btttb.exe88⤵PID:4396
-
\??\c:\3ddvp.exec:\3ddvp.exe89⤵PID:3372
-
\??\c:\xxrxxff.exec:\xxrxxff.exe90⤵PID:2720
-
\??\c:\xlrlrrr.exec:\xlrlrrr.exe91⤵PID:4648
-
\??\c:\bnnnhh.exec:\bnnnhh.exe92⤵PID:2020
-
\??\c:\vjjdp.exec:\vjjdp.exe93⤵PID:1700
-
\??\c:\lxfffff.exec:\lxfffff.exe94⤵PID:1996
-
\??\c:\bttnhh.exec:\bttnhh.exe95⤵PID:4924
-
\??\c:\dvjjd.exec:\dvjjd.exe96⤵PID:392
-
\??\c:\5jjdv.exec:\5jjdv.exe97⤵PID:3496
-
\??\c:\nbnbbt.exec:\nbnbbt.exe98⤵PID:2492
-
\??\c:\dpdpj.exec:\dpdpj.exe99⤵PID:3032
-
\??\c:\fflffxx.exec:\fflffxx.exe100⤵PID:660
-
\??\c:\tnhbbb.exec:\tnhbbb.exe101⤵PID:2460
-
\??\c:\jvvpd.exec:\jvvpd.exe102⤵PID:2620
-
\??\c:\3xlfxfr.exec:\3xlfxfr.exe103⤵PID:3880
-
\??\c:\bhnhhb.exec:\bhnhhb.exe104⤵PID:4880
-
\??\c:\vvvpv.exec:\vvvpv.exe105⤵PID:4752
-
\??\c:\1pvpj.exec:\1pvpj.exe106⤵PID:4576
-
\??\c:\rrxxrxx.exec:\rrxxrxx.exe107⤵PID:456
-
\??\c:\tnhbnn.exec:\tnhbnn.exe108⤵PID:3824
-
\??\c:\fffxxxr.exec:\fffxxxr.exe109⤵PID:2300
-
\??\c:\5hnhtt.exec:\5hnhtt.exe110⤵PID:452
-
\??\c:\nhhbbt.exec:\nhhbbt.exe111⤵PID:1420
-
\??\c:\3ppjd.exec:\3ppjd.exe112⤵PID:4188
-
\??\c:\llffffx.exec:\llffffx.exe113⤵PID:4296
-
\??\c:\thtnhb.exec:\thtnhb.exe114⤵PID:4208
-
\??\c:\7jvpp.exec:\7jvpp.exe115⤵PID:4532
-
\??\c:\xrxrfxr.exec:\xrxrfxr.exe116⤵PID:5088
-
\??\c:\tnbbth.exec:\tnbbth.exe117⤵PID:5012
-
\??\c:\dvppd.exec:\dvppd.exe118⤵PID:4144
-
\??\c:\fxffxrl.exec:\fxffxrl.exe119⤵PID:4476
-
\??\c:\bnnhht.exec:\bnnhht.exe120⤵PID:4948
-
\??\c:\pppjj.exec:\pppjj.exe121⤵PID:3016
-
\??\c:\dvvpj.exec:\dvvpj.exe122⤵PID:3568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-