Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 01:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b4241cffe9506c4942ba6323ead61f768a0a4e2d3e4c90c32bb2b402ec64a8a0.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b4241cffe9506c4942ba6323ead61f768a0a4e2d3e4c90c32bb2b402ec64a8a0.exe
-
Size
453KB
-
MD5
237db0dba06ba0ff851ab481e45b7465
-
SHA1
e52e1e83462c8b7e518d8c42d0c5a157c4530164
-
SHA256
b4241cffe9506c4942ba6323ead61f768a0a4e2d3e4c90c32bb2b402ec64a8a0
-
SHA512
627f7b6998f4c77d1bef4f78998998034085aa116a531abd8bc2665dab01af30f36609220f70eea20c92e4c839deda92d9b860f6f50a62672e66218ba43c3671
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeK:q7Tc2NYHUrAwfMp3CDK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3824-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1340-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3192-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2272-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3120-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2648-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2044-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3364-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/316-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/440-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1652-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/952-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2560-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3380-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/440-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2644-685-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1384-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-789-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-1027-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-1046-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1284 nbbthb.exe 4380 llrfrlx.exe 3444 rllfrrl.exe 4772 3tthhh.exe 1340 vddvp.exe 1932 lllllxx.exe 3056 nbthth.exe 4544 hbbnht.exe 1400 jjpjp.exe 3192 ntnhbb.exe 3144 pppdv.exe 5068 jppjv.exe 3916 httnbt.exe 4980 rrlxrlf.exe 4324 7btnbt.exe 2796 frlfxrf.exe 2272 bnhhhn.exe 2500 pddpp.exe 3404 jjpjd.exe 3092 lrxlfxx.exe 4828 thtnbt.exe 3120 vddpd.exe 2648 7bbnbt.exe 2044 jvvjv.exe 4452 tbhbbb.exe 1500 pjvjj.exe 1448 thnhhb.exe 3984 jppdp.exe 4200 dvdvv.exe 2420 fllxrlx.exe 212 3pjdp.exe 3364 rfrflfr.exe 4960 3lfrxrf.exe 1004 pppjj.exe 4536 rxxlxlx.exe 5084 ntbtnb.exe 1624 vppjd.exe 464 3rlxlxr.exe 1240 9bbthn.exe 3736 thhthb.exe 640 jpdvj.exe 1192 rllrrll.exe 4508 hhnhbb.exe 316 htthtn.exe 440 jdvdj.exe 1452 1xxllfr.exe 468 xxlxlfx.exe 436 nbhbnh.exe 1652 flfxfxl.exe 3852 fllxfxl.exe 224 1tnbnn.exe 452 vppvp.exe 3692 rlxrlll.exe 3700 rrrxrlf.exe 1084 nntnbt.exe 264 1jjjj.exe 2700 xrrllll.exe 4712 3nhbtt.exe 2740 djpjj.exe 1088 fxfxrlx.exe 3480 xllxfrl.exe 4544 nhhbnh.exe 952 ddjvp.exe 1392 llfrfxl.exe -
resource yara_rule behavioral2/memory/3824-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1340-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3192-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2272-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3120-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2648-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2044-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/316-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/440-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1652-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/952-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2560-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3380-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/440-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2644-685-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3824 wrote to memory of 1284 3824 b4241cffe9506c4942ba6323ead61f768a0a4e2d3e4c90c32bb2b402ec64a8a0.exe 82 PID 3824 wrote to memory of 1284 3824 b4241cffe9506c4942ba6323ead61f768a0a4e2d3e4c90c32bb2b402ec64a8a0.exe 82 PID 3824 wrote to memory of 1284 3824 b4241cffe9506c4942ba6323ead61f768a0a4e2d3e4c90c32bb2b402ec64a8a0.exe 82 PID 1284 wrote to memory of 4380 1284 nbbthb.exe 83 PID 1284 wrote to memory of 4380 1284 nbbthb.exe 83 PID 1284 wrote to memory of 4380 1284 nbbthb.exe 83 PID 4380 wrote to memory of 3444 4380 llrfrlx.exe 84 PID 4380 wrote to memory of 3444 4380 llrfrlx.exe 84 PID 4380 wrote to memory of 3444 4380 llrfrlx.exe 84 PID 3444 wrote to memory of 4772 3444 rllfrrl.exe 85 PID 3444 wrote to memory of 4772 3444 rllfrrl.exe 85 PID 3444 wrote to memory of 4772 3444 rllfrrl.exe 85 PID 4772 wrote to memory of 1340 4772 3tthhh.exe 86 PID 4772 wrote to memory of 1340 4772 3tthhh.exe 86 PID 4772 wrote to memory of 1340 4772 3tthhh.exe 86 PID 1340 wrote to memory of 1932 1340 vddvp.exe 87 PID 1340 wrote to memory of 1932 1340 vddvp.exe 87 PID 1340 wrote to memory of 1932 1340 vddvp.exe 87 PID 1932 wrote to memory of 3056 1932 lllllxx.exe 88 PID 1932 wrote to memory of 3056 1932 lllllxx.exe 88 PID 1932 wrote to memory of 3056 1932 lllllxx.exe 88 PID 3056 wrote to memory of 4544 3056 nbthth.exe 89 PID 3056 wrote to memory of 4544 3056 nbthth.exe 89 PID 3056 wrote to memory of 4544 3056 nbthth.exe 89 PID 4544 wrote to memory of 1400 4544 hbbnht.exe 90 PID 4544 wrote to memory of 1400 4544 hbbnht.exe 90 PID 4544 wrote to memory of 1400 4544 hbbnht.exe 90 PID 1400 wrote to memory of 3192 1400 jjpjp.exe 91 PID 1400 wrote to memory of 3192 1400 jjpjp.exe 91 PID 1400 wrote to memory of 3192 1400 jjpjp.exe 91 PID 3192 wrote to memory of 3144 3192 ntnhbb.exe 92 PID 3192 wrote to memory of 3144 3192 ntnhbb.exe 92 PID 3192 wrote to memory of 3144 3192 ntnhbb.exe 92 PID 3144 wrote to memory of 5068 3144 pppdv.exe 93 PID 3144 wrote to memory of 5068 3144 pppdv.exe 93 PID 3144 wrote to memory of 5068 3144 pppdv.exe 93 PID 5068 wrote to memory of 3916 5068 jppjv.exe 94 PID 5068 wrote to memory of 3916 5068 jppjv.exe 94 PID 5068 wrote to memory of 3916 5068 jppjv.exe 94 PID 3916 wrote to memory of 4980 3916 httnbt.exe 95 PID 3916 wrote to memory of 4980 3916 httnbt.exe 95 PID 3916 wrote to memory of 4980 3916 httnbt.exe 95 PID 4980 wrote to memory of 4324 4980 rrlxrlf.exe 96 PID 4980 wrote to memory of 4324 4980 rrlxrlf.exe 96 PID 4980 wrote to memory of 4324 4980 rrlxrlf.exe 96 PID 4324 wrote to memory of 2796 4324 7btnbt.exe 97 PID 4324 wrote to memory of 2796 4324 7btnbt.exe 97 PID 4324 wrote to memory of 2796 4324 7btnbt.exe 97 PID 2796 wrote to memory of 2272 2796 frlfxrf.exe 98 PID 2796 wrote to memory of 2272 2796 frlfxrf.exe 98 PID 2796 wrote to memory of 2272 2796 frlfxrf.exe 98 PID 2272 wrote to memory of 2500 2272 bnhhhn.exe 99 PID 2272 wrote to memory of 2500 2272 bnhhhn.exe 99 PID 2272 wrote to memory of 2500 2272 bnhhhn.exe 99 PID 2500 wrote to memory of 3404 2500 pddpp.exe 100 PID 2500 wrote to memory of 3404 2500 pddpp.exe 100 PID 2500 wrote to memory of 3404 2500 pddpp.exe 100 PID 3404 wrote to memory of 3092 3404 jjpjd.exe 101 PID 3404 wrote to memory of 3092 3404 jjpjd.exe 101 PID 3404 wrote to memory of 3092 3404 jjpjd.exe 101 PID 3092 wrote to memory of 4828 3092 lrxlfxx.exe 102 PID 3092 wrote to memory of 4828 3092 lrxlfxx.exe 102 PID 3092 wrote to memory of 4828 3092 lrxlfxx.exe 102 PID 4828 wrote to memory of 3120 4828 thtnbt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4241cffe9506c4942ba6323ead61f768a0a4e2d3e4c90c32bb2b402ec64a8a0.exe"C:\Users\Admin\AppData\Local\Temp\b4241cffe9506c4942ba6323ead61f768a0a4e2d3e4c90c32bb2b402ec64a8a0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\nbbthb.exec:\nbbthb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\llrfrlx.exec:\llrfrlx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\rllfrrl.exec:\rllfrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\3tthhh.exec:\3tthhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\vddvp.exec:\vddvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\lllllxx.exec:\lllllxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\nbthth.exec:\nbthth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\hbbnht.exec:\hbbnht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\jjpjp.exec:\jjpjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\ntnhbb.exec:\ntnhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\pppdv.exec:\pppdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\jppjv.exec:\jppjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\httnbt.exec:\httnbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\rrlxrlf.exec:\rrlxrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\7btnbt.exec:\7btnbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\frlfxrf.exec:\frlfxrf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\bnhhhn.exec:\bnhhhn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\pddpp.exec:\pddpp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\jjpjd.exec:\jjpjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\lrxlfxx.exec:\lrxlfxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\thtnbt.exec:\thtnbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\vddpd.exec:\vddpd.exe23⤵
- Executes dropped EXE
PID:3120 -
\??\c:\7bbnbt.exec:\7bbnbt.exe24⤵
- Executes dropped EXE
PID:2648 -
\??\c:\jvvjv.exec:\jvvjv.exe25⤵
- Executes dropped EXE
PID:2044 -
\??\c:\tbhbbb.exec:\tbhbbb.exe26⤵
- Executes dropped EXE
PID:4452 -
\??\c:\pjvjj.exec:\pjvjj.exe27⤵
- Executes dropped EXE
PID:1500 -
\??\c:\thnhhb.exec:\thnhhb.exe28⤵
- Executes dropped EXE
PID:1448 -
\??\c:\jppdp.exec:\jppdp.exe29⤵
- Executes dropped EXE
PID:3984 -
\??\c:\dvdvv.exec:\dvdvv.exe30⤵
- Executes dropped EXE
PID:4200 -
\??\c:\fllxrlx.exec:\fllxrlx.exe31⤵
- Executes dropped EXE
PID:2420 -
\??\c:\3pjdp.exec:\3pjdp.exe32⤵
- Executes dropped EXE
PID:212 -
\??\c:\rfrflfr.exec:\rfrflfr.exe33⤵
- Executes dropped EXE
PID:3364 -
\??\c:\3lfrxrf.exec:\3lfrxrf.exe34⤵
- Executes dropped EXE
PID:4960 -
\??\c:\pppjj.exec:\pppjj.exe35⤵
- Executes dropped EXE
PID:1004 -
\??\c:\rxxlxlx.exec:\rxxlxlx.exe36⤵
- Executes dropped EXE
PID:4536 -
\??\c:\ntbtnb.exec:\ntbtnb.exe37⤵
- Executes dropped EXE
PID:5084 -
\??\c:\vppjd.exec:\vppjd.exe38⤵
- Executes dropped EXE
PID:1624 -
\??\c:\3rlxlxr.exec:\3rlxlxr.exe39⤵
- Executes dropped EXE
PID:464 -
\??\c:\9bbthn.exec:\9bbthn.exe40⤵
- Executes dropped EXE
PID:1240 -
\??\c:\thhthb.exec:\thhthb.exe41⤵
- Executes dropped EXE
PID:3736 -
\??\c:\jpdvj.exec:\jpdvj.exe42⤵
- Executes dropped EXE
PID:640 -
\??\c:\rllrrll.exec:\rllrrll.exe43⤵
- Executes dropped EXE
PID:1192 -
\??\c:\hhnhbb.exec:\hhnhbb.exe44⤵
- Executes dropped EXE
PID:4508 -
\??\c:\htthtn.exec:\htthtn.exe45⤵
- Executes dropped EXE
PID:316 -
\??\c:\jdvdj.exec:\jdvdj.exe46⤵
- Executes dropped EXE
PID:440 -
\??\c:\1xxllfr.exec:\1xxllfr.exe47⤵
- Executes dropped EXE
PID:1452 -
\??\c:\xxlxlfx.exec:\xxlxlfx.exe48⤵
- Executes dropped EXE
PID:468 -
\??\c:\nbhbnh.exec:\nbhbnh.exe49⤵
- Executes dropped EXE
PID:436 -
\??\c:\flfxfxl.exec:\flfxfxl.exe50⤵
- Executes dropped EXE
PID:1652 -
\??\c:\fllxfxl.exec:\fllxfxl.exe51⤵
- Executes dropped EXE
PID:3852 -
\??\c:\1tnbnn.exec:\1tnbnn.exe52⤵
- Executes dropped EXE
PID:224 -
\??\c:\vppvp.exec:\vppvp.exe53⤵
- Executes dropped EXE
PID:452 -
\??\c:\rlxrlll.exec:\rlxrlll.exe54⤵
- Executes dropped EXE
PID:3692 -
\??\c:\rrrxrlf.exec:\rrrxrlf.exe55⤵
- Executes dropped EXE
PID:3700 -
\??\c:\nntnbt.exec:\nntnbt.exe56⤵
- Executes dropped EXE
PID:1084 -
\??\c:\1jjjj.exec:\1jjjj.exe57⤵
- Executes dropped EXE
PID:264 -
\??\c:\xrrllll.exec:\xrrllll.exe58⤵
- Executes dropped EXE
PID:2700 -
\??\c:\3nhbtt.exec:\3nhbtt.exe59⤵
- Executes dropped EXE
PID:4712 -
\??\c:\djpjj.exec:\djpjj.exe60⤵
- Executes dropped EXE
PID:2740 -
\??\c:\fxfxrlx.exec:\fxfxrlx.exe61⤵
- Executes dropped EXE
PID:1088 -
\??\c:\xllxfrl.exec:\xllxfrl.exe62⤵
- Executes dropped EXE
PID:3480 -
\??\c:\nhhbnh.exec:\nhhbnh.exe63⤵
- Executes dropped EXE
PID:4544 -
\??\c:\ddjvp.exec:\ddjvp.exe64⤵
- Executes dropped EXE
PID:952 -
\??\c:\llfrfxl.exec:\llfrfxl.exe65⤵
- Executes dropped EXE
PID:1392 -
\??\c:\7xfffxf.exec:\7xfffxf.exe66⤵PID:3192
-
\??\c:\htbthh.exec:\htbthh.exe67⤵PID:1908
-
\??\c:\vddpd.exec:\vddpd.exe68⤵PID:5068
-
\??\c:\lflrxxr.exec:\lflrxxr.exe69⤵PID:5020
-
\??\c:\thbbtt.exec:\thbbtt.exe70⤵PID:3916
-
\??\c:\5vpjj.exec:\5vpjj.exe71⤵PID:2772
-
\??\c:\7fxlxrf.exec:\7fxlxrf.exe72⤵PID:1956
-
\??\c:\1lrfllx.exec:\1lrfllx.exe73⤵PID:4128
-
\??\c:\thbnhb.exec:\thbnhb.exe74⤵PID:1592
-
\??\c:\pdvjd.exec:\pdvjd.exe75⤵PID:4060
-
\??\c:\rxllrxx.exec:\rxllrxx.exe76⤵PID:5108
-
\??\c:\nbbbbb.exec:\nbbbbb.exe77⤵PID:3528
-
\??\c:\vvdvj.exec:\vvdvj.exe78⤵PID:3164
-
\??\c:\fllfxxr.exec:\fllfxxr.exe79⤵PID:4984
-
\??\c:\hntntn.exec:\hntntn.exe80⤵PID:968
-
\??\c:\7nhthb.exec:\7nhthb.exe81⤵PID:4192
-
\??\c:\jjjdp.exec:\jjjdp.exe82⤵PID:2544
-
\??\c:\flxrrrx.exec:\flxrrrx.exe83⤵PID:4864
-
\??\c:\bhhhtn.exec:\bhhhtn.exe84⤵PID:2572
-
\??\c:\nbttnn.exec:\nbttnn.exe85⤵PID:3240
-
\??\c:\jpvpd.exec:\jpvpd.exe86⤵PID:696
-
\??\c:\7rxlxrr.exec:\7rxlxrr.exe87⤵PID:4452
-
\??\c:\tthbnn.exec:\tthbnn.exe88⤵PID:1356
-
\??\c:\jddvj.exec:\jddvj.exe89⤵PID:1960
-
\??\c:\jjdvp.exec:\jjdvp.exe90⤵PID:2612
-
\??\c:\fflfrlx.exec:\fflfrlx.exe91⤵PID:3060
-
\??\c:\bntnnt.exec:\bntnnt.exe92⤵PID:1380
-
\??\c:\vdjvj.exec:\vdjvj.exe93⤵PID:2228
-
\??\c:\9pvjv.exec:\9pvjv.exe94⤵PID:228
-
\??\c:\xlrlrrx.exec:\xlrlrrx.exe95⤵PID:2560
-
\??\c:\xllfxfx.exec:\xllfxfx.exe96⤵PID:3028
-
\??\c:\nhbtnh.exec:\nhbtnh.exe97⤵PID:4540
-
\??\c:\5vvpd.exec:\5vvpd.exe98⤵PID:2268
-
\??\c:\fxxlrrf.exec:\fxxlrrf.exe99⤵PID:1464
-
\??\c:\tnhtnh.exec:\tnhtnh.exe100⤵PID:432
-
\??\c:\vpjvj.exec:\vpjvj.exe101⤵PID:3380
-
\??\c:\dvddj.exec:\dvddj.exe102⤵PID:3484
-
\??\c:\frxlxxr.exec:\frxlxxr.exe103⤵PID:4632
-
\??\c:\bththt.exec:\bththt.exe104⤵PID:3488
-
\??\c:\nbtnbt.exec:\nbtnbt.exe105⤵PID:3880
-
\??\c:\vpjvp.exec:\vpjvp.exe106⤵PID:1768
-
\??\c:\rlfxlfr.exec:\rlfxlfr.exe107⤵PID:4428
-
\??\c:\htbtnn.exec:\htbtnn.exe108⤵PID:1192
-
\??\c:\vjjdp.exec:\vjjdp.exe109⤵PID:4508
-
\??\c:\vdpvj.exec:\vdpvj.exe110⤵PID:1000
-
\??\c:\rfrlffl.exec:\rfrlffl.exe111⤵PID:440
-
\??\c:\ntthbt.exec:\ntthbt.exe112⤵PID:4760
-
\??\c:\5nnbnh.exec:\5nnbnh.exe113⤵PID:3216
-
\??\c:\jpvpd.exec:\jpvpd.exe114⤵PID:4316
-
\??\c:\5ppjv.exec:\5ppjv.exe115⤵PID:1652
-
\??\c:\rflxrlf.exec:\rflxrlf.exe116⤵PID:2940
-
\??\c:\1nhbnt.exec:\1nhbnt.exe117⤵PID:3428
-
\??\c:\pppdp.exec:\pppdp.exe118⤵PID:4556
-
\??\c:\rrrlllx.exec:\rrrlllx.exe119⤵PID:4468
-
\??\c:\tnbhth.exec:\tnbhth.exe120⤵PID:2908
-
\??\c:\hbbbnh.exec:\hbbbnh.exe121⤵PID:4948
-
\??\c:\3pppp.exec:\3pppp.exe122⤵PID:1340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-