Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 01:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dd7d5b2aa1fccd3b9d5a05806a9e91cd1554143edcf4dea4e2eaf338ff25db2f.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
dd7d5b2aa1fccd3b9d5a05806a9e91cd1554143edcf4dea4e2eaf338ff25db2f.exe
-
Size
456KB
-
MD5
656dc348691e88993ace2835252d4ac1
-
SHA1
481a28d2dbedaf72d434cfae0c5406fbb9836160
-
SHA256
dd7d5b2aa1fccd3b9d5a05806a9e91cd1554143edcf4dea4e2eaf338ff25db2f
-
SHA512
a1323ae911c9546573b5ccb7c08ca36e3ad6c2d2c252b0d983e5d319ab4850d6b7fbb970861d5911945b117c1ec42b98c144005e0180581201dde2b4f64fab05
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeLe:q7Tc2NYHUrAwfMp3CDLe
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/5056-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1292-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2652-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4120-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4140-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/524-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4116-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1112-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2196-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3884-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2292-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1084-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1148-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/808-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1164-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3908-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3084-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2652-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-640-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-647-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-708-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-868-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-1042-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1712-1070-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1292 tbhbnh.exe 3580 tbhbnn.exe 2652 rfrxrrx.exe 4340 pddpj.exe 2640 xfxxfff.exe 4508 7nbttt.exe 1808 llffxxl.exe 4120 hbhhbt.exe 4528 ttnhhn.exe 4140 fxxxxff.exe 4808 ddjdp.exe 524 5lxrrrf.exe 4692 hbtthn.exe 3188 3pjdj.exe 4020 nhnnbt.exe 3996 xllrlxr.exe 3524 htbtnh.exe 1656 pdvpd.exe 2148 hnbttn.exe 1916 1xxlffr.exe 2312 1nnbtt.exe 1716 7xxrllf.exe 3620 jpvpj.exe 4832 5dvjj.exe 1840 ddpvp.exe 4116 frrfrxr.exe 1236 ppvpd.exe 4948 btnhbt.exe 4780 1bhbbt.exe 408 3xlfxrr.exe 1112 bbbtnh.exe 2196 nhhbtt.exe 4420 jpvvv.exe 2972 5btnhh.exe 3928 tththh.exe 2184 rlrlffx.exe 3884 tnnhhb.exe 3540 jdppp.exe 3948 lxlxllx.exe 3944 1jjdd.exe 2716 pdvjv.exe 5108 frxrllf.exe 2292 ntthbb.exe 4552 ppddd.exe 3080 vpjjv.exe 3940 xxrrrrr.exe 4988 hnbnht.exe 1084 vdpdp.exe 2736 rxrrrxx.exe 380 thhbtt.exe 4704 pvdvj.exe 4760 fxlflfr.exe 4108 rllffff.exe 1572 nhhtnh.exe 1148 7ppjv.exe 808 flxlrrl.exe 2668 htbttn.exe 4644 ttnhbh.exe 860 jjddv.exe 2884 lrffxxr.exe 4548 hnnhbh.exe 3348 vvdvv.exe 1776 lrlllff.exe 4140 nhnhnn.exe -
resource yara_rule behavioral2/memory/5056-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1292-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1808-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4120-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4140-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/524-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4116-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1112-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2196-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3884-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1084-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4108-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1148-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/808-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1164-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3908-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3084-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-708-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-868-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-1032-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5056 wrote to memory of 1292 5056 dd7d5b2aa1fccd3b9d5a05806a9e91cd1554143edcf4dea4e2eaf338ff25db2f.exe 83 PID 5056 wrote to memory of 1292 5056 dd7d5b2aa1fccd3b9d5a05806a9e91cd1554143edcf4dea4e2eaf338ff25db2f.exe 83 PID 5056 wrote to memory of 1292 5056 dd7d5b2aa1fccd3b9d5a05806a9e91cd1554143edcf4dea4e2eaf338ff25db2f.exe 83 PID 1292 wrote to memory of 3580 1292 tbhbnh.exe 84 PID 1292 wrote to memory of 3580 1292 tbhbnh.exe 84 PID 1292 wrote to memory of 3580 1292 tbhbnh.exe 84 PID 3580 wrote to memory of 2652 3580 tbhbnn.exe 85 PID 3580 wrote to memory of 2652 3580 tbhbnn.exe 85 PID 3580 wrote to memory of 2652 3580 tbhbnn.exe 85 PID 2652 wrote to memory of 4340 2652 rfrxrrx.exe 86 PID 2652 wrote to memory of 4340 2652 rfrxrrx.exe 86 PID 2652 wrote to memory of 4340 2652 rfrxrrx.exe 86 PID 4340 wrote to memory of 2640 4340 pddpj.exe 87 PID 4340 wrote to memory of 2640 4340 pddpj.exe 87 PID 4340 wrote to memory of 2640 4340 pddpj.exe 87 PID 2640 wrote to memory of 4508 2640 xfxxfff.exe 88 PID 2640 wrote to memory of 4508 2640 xfxxfff.exe 88 PID 2640 wrote to memory of 4508 2640 xfxxfff.exe 88 PID 4508 wrote to memory of 1808 4508 7nbttt.exe 89 PID 4508 wrote to memory of 1808 4508 7nbttt.exe 89 PID 4508 wrote to memory of 1808 4508 7nbttt.exe 89 PID 1808 wrote to memory of 4120 1808 llffxxl.exe 90 PID 1808 wrote to memory of 4120 1808 llffxxl.exe 90 PID 1808 wrote to memory of 4120 1808 llffxxl.exe 90 PID 4120 wrote to memory of 4528 4120 hbhhbt.exe 91 PID 4120 wrote to memory of 4528 4120 hbhhbt.exe 91 PID 4120 wrote to memory of 4528 4120 hbhhbt.exe 91 PID 4528 wrote to memory of 4140 4528 ttnhhn.exe 92 PID 4528 wrote to memory of 4140 4528 ttnhhn.exe 92 PID 4528 wrote to memory of 4140 4528 ttnhhn.exe 92 PID 4140 wrote to memory of 4808 4140 fxxxxff.exe 93 PID 4140 wrote to memory of 4808 4140 fxxxxff.exe 93 PID 4140 wrote to memory of 4808 4140 fxxxxff.exe 93 PID 4808 wrote to memory of 524 4808 ddjdp.exe 94 PID 4808 wrote to memory of 524 4808 ddjdp.exe 94 PID 4808 wrote to memory of 524 4808 ddjdp.exe 94 PID 524 wrote to memory of 4692 524 5lxrrrf.exe 95 PID 524 wrote to memory of 4692 524 5lxrrrf.exe 95 PID 524 wrote to memory of 4692 524 5lxrrrf.exe 95 PID 4692 wrote to memory of 3188 4692 hbtthn.exe 96 PID 4692 wrote to memory of 3188 4692 hbtthn.exe 96 PID 4692 wrote to memory of 3188 4692 hbtthn.exe 96 PID 3188 wrote to memory of 4020 3188 3pjdj.exe 97 PID 3188 wrote to memory of 4020 3188 3pjdj.exe 97 PID 3188 wrote to memory of 4020 3188 3pjdj.exe 97 PID 4020 wrote to memory of 3996 4020 nhnnbt.exe 98 PID 4020 wrote to memory of 3996 4020 nhnnbt.exe 98 PID 4020 wrote to memory of 3996 4020 nhnnbt.exe 98 PID 3996 wrote to memory of 3524 3996 xllrlxr.exe 99 PID 3996 wrote to memory of 3524 3996 xllrlxr.exe 99 PID 3996 wrote to memory of 3524 3996 xllrlxr.exe 99 PID 3524 wrote to memory of 1656 3524 htbtnh.exe 100 PID 3524 wrote to memory of 1656 3524 htbtnh.exe 100 PID 3524 wrote to memory of 1656 3524 htbtnh.exe 100 PID 1656 wrote to memory of 2148 1656 pdvpd.exe 101 PID 1656 wrote to memory of 2148 1656 pdvpd.exe 101 PID 1656 wrote to memory of 2148 1656 pdvpd.exe 101 PID 2148 wrote to memory of 1916 2148 hnbttn.exe 102 PID 2148 wrote to memory of 1916 2148 hnbttn.exe 102 PID 2148 wrote to memory of 1916 2148 hnbttn.exe 102 PID 1916 wrote to memory of 2312 1916 1xxlffr.exe 103 PID 1916 wrote to memory of 2312 1916 1xxlffr.exe 103 PID 1916 wrote to memory of 2312 1916 1xxlffr.exe 103 PID 2312 wrote to memory of 1716 2312 1nnbtt.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd7d5b2aa1fccd3b9d5a05806a9e91cd1554143edcf4dea4e2eaf338ff25db2f.exe"C:\Users\Admin\AppData\Local\Temp\dd7d5b2aa1fccd3b9d5a05806a9e91cd1554143edcf4dea4e2eaf338ff25db2f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\tbhbnh.exec:\tbhbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\tbhbnn.exec:\tbhbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\rfrxrrx.exec:\rfrxrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\pddpj.exec:\pddpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\xfxxfff.exec:\xfxxfff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\7nbttt.exec:\7nbttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\llffxxl.exec:\llffxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\hbhhbt.exec:\hbhhbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\ttnhhn.exec:\ttnhhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\fxxxxff.exec:\fxxxxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\ddjdp.exec:\ddjdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\5lxrrrf.exec:\5lxrrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:524 -
\??\c:\hbtthn.exec:\hbtthn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\3pjdj.exec:\3pjdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\nhnnbt.exec:\nhnnbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\xllrlxr.exec:\xllrlxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\htbtnh.exec:\htbtnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\pdvpd.exec:\pdvpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\hnbttn.exec:\hnbttn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\1xxlffr.exec:\1xxlffr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\1nnbtt.exec:\1nnbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\7xxrllf.exec:\7xxrllf.exe23⤵
- Executes dropped EXE
PID:1716 -
\??\c:\jpvpj.exec:\jpvpj.exe24⤵
- Executes dropped EXE
PID:3620 -
\??\c:\5dvjj.exec:\5dvjj.exe25⤵
- Executes dropped EXE
PID:4832 -
\??\c:\ddpvp.exec:\ddpvp.exe26⤵
- Executes dropped EXE
PID:1840 -
\??\c:\frrfrxr.exec:\frrfrxr.exe27⤵
- Executes dropped EXE
PID:4116 -
\??\c:\ppvpd.exec:\ppvpd.exe28⤵
- Executes dropped EXE
PID:1236 -
\??\c:\btnhbt.exec:\btnhbt.exe29⤵
- Executes dropped EXE
PID:4948 -
\??\c:\1bhbbt.exec:\1bhbbt.exe30⤵
- Executes dropped EXE
PID:4780 -
\??\c:\3xlfxrr.exec:\3xlfxrr.exe31⤵
- Executes dropped EXE
PID:408 -
\??\c:\bbbtnh.exec:\bbbtnh.exe32⤵
- Executes dropped EXE
PID:1112 -
\??\c:\nhhbtt.exec:\nhhbtt.exe33⤵
- Executes dropped EXE
PID:2196 -
\??\c:\jpvvv.exec:\jpvvv.exe34⤵
- Executes dropped EXE
PID:4420 -
\??\c:\5btnhh.exec:\5btnhh.exe35⤵
- Executes dropped EXE
PID:2972 -
\??\c:\tththh.exec:\tththh.exe36⤵
- Executes dropped EXE
PID:3928 -
\??\c:\rlrlffx.exec:\rlrlffx.exe37⤵
- Executes dropped EXE
PID:2184 -
\??\c:\tnnhhb.exec:\tnnhhb.exe38⤵
- Executes dropped EXE
PID:3884 -
\??\c:\jdppp.exec:\jdppp.exe39⤵
- Executes dropped EXE
PID:3540 -
\??\c:\lxlxllx.exec:\lxlxllx.exe40⤵
- Executes dropped EXE
PID:3948 -
\??\c:\1jjdd.exec:\1jjdd.exe41⤵
- Executes dropped EXE
PID:3944 -
\??\c:\pdvjv.exec:\pdvjv.exe42⤵
- Executes dropped EXE
PID:2716 -
\??\c:\frxrllf.exec:\frxrllf.exe43⤵
- Executes dropped EXE
PID:5108 -
\??\c:\ntthbb.exec:\ntthbb.exe44⤵
- Executes dropped EXE
PID:2292 -
\??\c:\ppddd.exec:\ppddd.exe45⤵
- Executes dropped EXE
PID:4552 -
\??\c:\vpjjv.exec:\vpjjv.exe46⤵
- Executes dropped EXE
PID:3080 -
\??\c:\xxrrrrr.exec:\xxrrrrr.exe47⤵
- Executes dropped EXE
PID:3940 -
\??\c:\hnbnht.exec:\hnbnht.exe48⤵
- Executes dropped EXE
PID:4988 -
\??\c:\vdpdp.exec:\vdpdp.exe49⤵
- Executes dropped EXE
PID:1084 -
\??\c:\rxrrrxx.exec:\rxrrrxx.exe50⤵
- Executes dropped EXE
PID:2736 -
\??\c:\thhbtt.exec:\thhbtt.exe51⤵
- Executes dropped EXE
PID:380 -
\??\c:\pvdvj.exec:\pvdvj.exe52⤵
- Executes dropped EXE
PID:4704 -
\??\c:\fxlflfr.exec:\fxlflfr.exe53⤵
- Executes dropped EXE
PID:4760 -
\??\c:\rllffff.exec:\rllffff.exe54⤵
- Executes dropped EXE
PID:4108 -
\??\c:\nhhtnh.exec:\nhhtnh.exe55⤵
- Executes dropped EXE
PID:1572 -
\??\c:\7ppjv.exec:\7ppjv.exe56⤵
- Executes dropped EXE
PID:1148 -
\??\c:\flxlrrl.exec:\flxlrrl.exe57⤵
- Executes dropped EXE
PID:808 -
\??\c:\htbttn.exec:\htbttn.exe58⤵
- Executes dropped EXE
PID:2668 -
\??\c:\ttnhbh.exec:\ttnhbh.exe59⤵
- Executes dropped EXE
PID:4644 -
\??\c:\jjddv.exec:\jjddv.exe60⤵
- Executes dropped EXE
PID:860 -
\??\c:\lrffxxr.exec:\lrffxxr.exe61⤵
- Executes dropped EXE
PID:2884 -
\??\c:\hnnhbh.exec:\hnnhbh.exe62⤵
- Executes dropped EXE
PID:4548 -
\??\c:\vvdvv.exec:\vvdvv.exe63⤵
- Executes dropped EXE
PID:3348 -
\??\c:\lrlllff.exec:\lrlllff.exe64⤵
- Executes dropped EXE
PID:1776 -
\??\c:\nhnhnn.exec:\nhnhnn.exe65⤵
- Executes dropped EXE
PID:4140 -
\??\c:\pvjpj.exec:\pvjpj.exe66⤵PID:1164
-
\??\c:\7xxlrlf.exec:\7xxlrlf.exe67⤵PID:1928
-
\??\c:\btthtn.exec:\btthtn.exe68⤵PID:384
-
\??\c:\hhnhbt.exec:\hhnhbt.exe69⤵PID:5088
-
\??\c:\vppjv.exec:\vppjv.exe70⤵PID:60
-
\??\c:\dppjj.exec:\dppjj.exe71⤵PID:4020
-
\??\c:\lfrxfrf.exec:\lfrxfrf.exe72⤵PID:2216
-
\??\c:\9tnhtt.exec:\9tnhtt.exe73⤵PID:3908
-
\??\c:\hhnhbh.exec:\hhnhbh.exe74⤵PID:4480
-
\??\c:\vpdvp.exec:\vpdvp.exe75⤵PID:4612
-
\??\c:\ffrfxrl.exec:\ffrfxrl.exe76⤵PID:4896
-
\??\c:\5ntnbb.exec:\5ntnbb.exe77⤵PID:5092
-
\??\c:\bbhbnn.exec:\bbhbnn.exe78⤵PID:4560
-
\??\c:\jvdvp.exec:\jvdvp.exe79⤵PID:3084
-
\??\c:\lxrfrrl.exec:\lxrfrrl.exe80⤵PID:2312
-
\??\c:\flfxrlf.exec:\flfxrlf.exe81⤵PID:2968
-
\??\c:\1hbtnn.exec:\1hbtnn.exe82⤵PID:3684
-
\??\c:\dppdp.exec:\dppdp.exe83⤵PID:1712
-
\??\c:\7xxlllf.exec:\7xxlllf.exe84⤵PID:3804
-
\??\c:\frrlffx.exec:\frrlffx.exe85⤵PID:4944
-
\??\c:\btbthb.exec:\btbthb.exe86⤵PID:4416
-
\??\c:\pjpjj.exec:\pjpjj.exe87⤵PID:756
-
\??\c:\fxrlxrr.exec:\fxrlxrr.exe88⤵PID:3172
-
\??\c:\fllllff.exec:\fllllff.exe89⤵PID:4496
-
\??\c:\9nnhtt.exec:\9nnhtt.exe90⤵PID:1020
-
\??\c:\7ddvv.exec:\7ddvv.exe91⤵PID:876
-
\??\c:\xxfxffl.exec:\xxfxffl.exe92⤵PID:880
-
\??\c:\xfxlffr.exec:\xfxlffr.exe93⤵
- System Location Discovery: System Language Discovery
PID:2812 -
\??\c:\hnbtnt.exec:\hnbtnt.exe94⤵PID:1592
-
\??\c:\5vvpd.exec:\5vvpd.exe95⤵PID:2244
-
\??\c:\vpvpv.exec:\vpvpv.exe96⤵PID:5020
-
\??\c:\fxrfrlf.exec:\fxrfrlf.exe97⤵PID:4240
-
\??\c:\btthhb.exec:\btthhb.exe98⤵PID:4660
-
\??\c:\jjpjj.exec:\jjpjj.exe99⤵PID:2184
-
\??\c:\xfrlfff.exec:\xfrlfff.exe100⤵PID:1820
-
\??\c:\ntbnhh.exec:\ntbnhh.exe101⤵PID:4144
-
\??\c:\dpvjd.exec:\dpvjd.exe102⤵PID:4920
-
\??\c:\7djjj.exec:\7djjj.exe103⤵PID:4332
-
\??\c:\flrrllr.exec:\flrrllr.exe104⤵PID:3232
-
\??\c:\flrlxrf.exec:\flrlxrf.exe105⤵PID:2164
-
\??\c:\hntnhh.exec:\hntnhh.exe106⤵PID:1992
-
\??\c:\7dvpj.exec:\7dvpj.exe107⤵PID:4968
-
\??\c:\fxfxlll.exec:\fxfxlll.exe108⤵PID:2544
-
\??\c:\xxxrllf.exec:\xxxrllf.exe109⤵PID:4792
-
\??\c:\htbhbb.exec:\htbhbb.exe110⤵PID:2012
-
\??\c:\9vddj.exec:\9vddj.exe111⤵PID:4988
-
\??\c:\xllfxrl.exec:\xllfxrl.exe112⤵PID:1084
-
\??\c:\5nhbbb.exec:\5nhbbb.exe113⤵PID:2192
-
\??\c:\nbbnhb.exec:\nbbnhb.exe114⤵PID:468
-
\??\c:\djpjj.exec:\djpjj.exe115⤵PID:2868
-
\??\c:\xlrflff.exec:\xlrflff.exe116⤵PID:2652
-
\??\c:\llffxxr.exec:\llffxxr.exe117⤵PID:4108
-
\??\c:\1nnhbb.exec:\1nnhbb.exe118⤵PID:4340
-
\??\c:\1ntnhh.exec:\1ntnhh.exe119⤵PID:4772
-
\??\c:\pvdvv.exec:\pvdvv.exe120⤵PID:3876
-
\??\c:\1xrfxrl.exec:\1xrfxrl.exe121⤵PID:3488
-
\??\c:\7tthbt.exec:\7tthbt.exe122⤵PID:5040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-