Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 04:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bc3d7216242570c96bc6fefab24697b4fe31eae2f4bbc392b27a9dd22fdce535.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
bc3d7216242570c96bc6fefab24697b4fe31eae2f4bbc392b27a9dd22fdce535.exe
-
Size
454KB
-
MD5
d2bd3fc95c6d821deb4aedd51acf9e22
-
SHA1
07e87305e9abb7dbd3f7eed30dc471b7f4447be3
-
SHA256
bc3d7216242570c96bc6fefab24697b4fe31eae2f4bbc392b27a9dd22fdce535
-
SHA512
416694643c205787146b0f7547f5e9eba54b50ef6d75328634cb04eeab2d50ebf2f1fb9ccd40d94d3e841daa7cdae57ee5c4cf085679653e6e0c29aebdeb12cc
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4768-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1288-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1108-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4080-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1496-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1776-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1080-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3416-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/724-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-645-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-649-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-692-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-711-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-721-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/956-737-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-753-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-806-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-813-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-1096-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-1338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-1951-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3196 xxfxlfx.exe 2016 hbbbbt.exe 3680 5nnbtn.exe 548 7dvpp.exe 1288 llxxlfl.exe 1776 bthhnt.exe 1108 ppvjv.exe 2460 flrlfff.exe 2420 jddpv.exe 2640 1dvvj.exe 5000 rfrlxlf.exe 2708 7tnhhh.exe 4080 7vdvp.exe 2208 1rrlfxr.exe 1596 hbtnnb.exe 4400 pddvp.exe 2320 fxrrllf.exe 3292 3nhbtt.exe 4600 1jjvp.exe 1056 frxxrrr.exe 1540 nbbnhb.exe 2940 3djvv.exe 2500 frrllff.exe 2336 hhnbnt.exe 4704 pjjdv.exe 3136 rllrrrf.exe 436 rxfxrrl.exe 2128 hbbtnn.exe 2984 pjjpp.exe 2816 5xfxlff.exe 1248 rlrrrrr.exe 5040 tnnhbt.exe 1752 jjjdp.exe 2196 7rrrxfx.exe 4524 tnbntt.exe 1496 btbtbt.exe 3512 jdpjd.exe 4716 lxxxrxr.exe 1356 vjjjd.exe 2488 vjdvv.exe 1688 xxrlfrl.exe 4276 rflxrlf.exe 4288 1hhhbh.exe 3932 jjpdp.exe 3196 vjpvj.exe 4488 lfrxlff.exe 5080 htbtnh.exe 1296 ttbnhb.exe 1160 dppjv.exe 1860 xrrlfxr.exe 3604 lffxrff.exe 3228 3ntnhh.exe 4316 ddddv.exe 1376 9pjdj.exe 4872 7llfxfx.exe 2420 bbhhhh.exe 1964 7pjdv.exe 4584 rfffxxx.exe 5000 lfrlrlr.exe 1440 hhthtn.exe 3056 djjdd.exe 4448 nbbhbb.exe 3248 vpdjd.exe 3120 bttnnh.exe -
resource yara_rule behavioral2/memory/4768-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1288-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1108-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4080-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2196-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2488-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3416-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/724-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-711-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/956-737-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-753-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2824-760-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-806-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-813-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4768 wrote to memory of 3196 4768 bc3d7216242570c96bc6fefab24697b4fe31eae2f4bbc392b27a9dd22fdce535.exe 83 PID 4768 wrote to memory of 3196 4768 bc3d7216242570c96bc6fefab24697b4fe31eae2f4bbc392b27a9dd22fdce535.exe 83 PID 4768 wrote to memory of 3196 4768 bc3d7216242570c96bc6fefab24697b4fe31eae2f4bbc392b27a9dd22fdce535.exe 83 PID 3196 wrote to memory of 2016 3196 xxfxlfx.exe 84 PID 3196 wrote to memory of 2016 3196 xxfxlfx.exe 84 PID 3196 wrote to memory of 2016 3196 xxfxlfx.exe 84 PID 2016 wrote to memory of 3680 2016 hbbbbt.exe 85 PID 2016 wrote to memory of 3680 2016 hbbbbt.exe 85 PID 2016 wrote to memory of 3680 2016 hbbbbt.exe 85 PID 3680 wrote to memory of 548 3680 5nnbtn.exe 86 PID 3680 wrote to memory of 548 3680 5nnbtn.exe 86 PID 3680 wrote to memory of 548 3680 5nnbtn.exe 86 PID 548 wrote to memory of 1288 548 7dvpp.exe 87 PID 548 wrote to memory of 1288 548 7dvpp.exe 87 PID 548 wrote to memory of 1288 548 7dvpp.exe 87 PID 1288 wrote to memory of 1776 1288 llxxlfl.exe 88 PID 1288 wrote to memory of 1776 1288 llxxlfl.exe 88 PID 1288 wrote to memory of 1776 1288 llxxlfl.exe 88 PID 1776 wrote to memory of 1108 1776 bthhnt.exe 89 PID 1776 wrote to memory of 1108 1776 bthhnt.exe 89 PID 1776 wrote to memory of 1108 1776 bthhnt.exe 89 PID 1108 wrote to memory of 2460 1108 ppvjv.exe 90 PID 1108 wrote to memory of 2460 1108 ppvjv.exe 90 PID 1108 wrote to memory of 2460 1108 ppvjv.exe 90 PID 2460 wrote to memory of 2420 2460 flrlfff.exe 138 PID 2460 wrote to memory of 2420 2460 flrlfff.exe 138 PID 2460 wrote to memory of 2420 2460 flrlfff.exe 138 PID 2420 wrote to memory of 2640 2420 jddpv.exe 92 PID 2420 wrote to memory of 2640 2420 jddpv.exe 92 PID 2420 wrote to memory of 2640 2420 jddpv.exe 92 PID 2640 wrote to memory of 5000 2640 1dvvj.exe 141 PID 2640 wrote to memory of 5000 2640 1dvvj.exe 141 PID 2640 wrote to memory of 5000 2640 1dvvj.exe 141 PID 5000 wrote to memory of 2708 5000 rfrlxlf.exe 94 PID 5000 wrote to memory of 2708 5000 rfrlxlf.exe 94 PID 5000 wrote to memory of 2708 5000 rfrlxlf.exe 94 PID 2708 wrote to memory of 4080 2708 7tnhhh.exe 95 PID 2708 wrote to memory of 4080 2708 7tnhhh.exe 95 PID 2708 wrote to memory of 4080 2708 7tnhhh.exe 95 PID 4080 wrote to memory of 2208 4080 7vdvp.exe 96 PID 4080 wrote to memory of 2208 4080 7vdvp.exe 96 PID 4080 wrote to memory of 2208 4080 7vdvp.exe 96 PID 2208 wrote to memory of 1596 2208 1rrlfxr.exe 97 PID 2208 wrote to memory of 1596 2208 1rrlfxr.exe 97 PID 2208 wrote to memory of 1596 2208 1rrlfxr.exe 97 PID 1596 wrote to memory of 4400 1596 hbtnnb.exe 98 PID 1596 wrote to memory of 4400 1596 hbtnnb.exe 98 PID 1596 wrote to memory of 4400 1596 hbtnnb.exe 98 PID 4400 wrote to memory of 2320 4400 pddvp.exe 99 PID 4400 wrote to memory of 2320 4400 pddvp.exe 99 PID 4400 wrote to memory of 2320 4400 pddvp.exe 99 PID 2320 wrote to memory of 3292 2320 fxrrllf.exe 100 PID 2320 wrote to memory of 3292 2320 fxrrllf.exe 100 PID 2320 wrote to memory of 3292 2320 fxrrllf.exe 100 PID 3292 wrote to memory of 4600 3292 3nhbtt.exe 101 PID 3292 wrote to memory of 4600 3292 3nhbtt.exe 101 PID 3292 wrote to memory of 4600 3292 3nhbtt.exe 101 PID 4600 wrote to memory of 1056 4600 1jjvp.exe 102 PID 4600 wrote to memory of 1056 4600 1jjvp.exe 102 PID 4600 wrote to memory of 1056 4600 1jjvp.exe 102 PID 1056 wrote to memory of 1540 1056 frxxrrr.exe 103 PID 1056 wrote to memory of 1540 1056 frxxrrr.exe 103 PID 1056 wrote to memory of 1540 1056 frxxrrr.exe 103 PID 1540 wrote to memory of 2940 1540 nbbnhb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc3d7216242570c96bc6fefab24697b4fe31eae2f4bbc392b27a9dd22fdce535.exe"C:\Users\Admin\AppData\Local\Temp\bc3d7216242570c96bc6fefab24697b4fe31eae2f4bbc392b27a9dd22fdce535.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\xxfxlfx.exec:\xxfxlfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\hbbbbt.exec:\hbbbbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\5nnbtn.exec:\5nnbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\7dvpp.exec:\7dvpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\llxxlfl.exec:\llxxlfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\bthhnt.exec:\bthhnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\ppvjv.exec:\ppvjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\flrlfff.exec:\flrlfff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\jddpv.exec:\jddpv.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\1dvvj.exec:\1dvvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\rfrlxlf.exec:\rfrlxlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\7tnhhh.exec:\7tnhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\7vdvp.exec:\7vdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\1rrlfxr.exec:\1rrlfxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\hbtnnb.exec:\hbtnnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\pddvp.exec:\pddvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\fxrrllf.exec:\fxrrllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\3nhbtt.exec:\3nhbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\1jjvp.exec:\1jjvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\frxxrrr.exec:\frxxrrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\nbbnhb.exec:\nbbnhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\3djvv.exec:\3djvv.exe23⤵
- Executes dropped EXE
PID:2940 -
\??\c:\frrllff.exec:\frrllff.exe24⤵
- Executes dropped EXE
PID:2500 -
\??\c:\hhnbnt.exec:\hhnbnt.exe25⤵
- Executes dropped EXE
PID:2336 -
\??\c:\pjjdv.exec:\pjjdv.exe26⤵
- Executes dropped EXE
PID:4704 -
\??\c:\rllrrrf.exec:\rllrrrf.exe27⤵
- Executes dropped EXE
PID:3136 -
\??\c:\rxfxrrl.exec:\rxfxrrl.exe28⤵
- Executes dropped EXE
PID:436 -
\??\c:\hbbtnn.exec:\hbbtnn.exe29⤵
- Executes dropped EXE
PID:2128 -
\??\c:\pjjpp.exec:\pjjpp.exe30⤵
- Executes dropped EXE
PID:2984 -
\??\c:\5xfxlff.exec:\5xfxlff.exe31⤵
- Executes dropped EXE
PID:2816 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe32⤵
- Executes dropped EXE
PID:1248 -
\??\c:\tnnhbt.exec:\tnnhbt.exe33⤵
- Executes dropped EXE
PID:5040 -
\??\c:\jjjdp.exec:\jjjdp.exe34⤵
- Executes dropped EXE
PID:1752 -
\??\c:\7rrrxfx.exec:\7rrrxfx.exe35⤵
- Executes dropped EXE
PID:2196 -
\??\c:\tnbntt.exec:\tnbntt.exe36⤵
- Executes dropped EXE
PID:4524 -
\??\c:\btbtbt.exec:\btbtbt.exe37⤵
- Executes dropped EXE
PID:1496 -
\??\c:\jdpjd.exec:\jdpjd.exe38⤵
- Executes dropped EXE
PID:3512 -
\??\c:\lxxxrxr.exec:\lxxxrxr.exe39⤵
- Executes dropped EXE
PID:4716 -
\??\c:\vjjjd.exec:\vjjjd.exe40⤵
- Executes dropped EXE
PID:1356 -
\??\c:\vjdvv.exec:\vjdvv.exe41⤵
- Executes dropped EXE
PID:2488 -
\??\c:\xxrlfrl.exec:\xxrlfrl.exe42⤵
- Executes dropped EXE
PID:1688 -
\??\c:\rflxrlf.exec:\rflxrlf.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4276 -
\??\c:\1hhhbh.exec:\1hhhbh.exe44⤵
- Executes dropped EXE
PID:4288 -
\??\c:\jjpdp.exec:\jjpdp.exe45⤵
- Executes dropped EXE
PID:3932 -
\??\c:\vjpvj.exec:\vjpvj.exe46⤵
- Executes dropped EXE
PID:3196 -
\??\c:\lfrxlff.exec:\lfrxlff.exe47⤵
- Executes dropped EXE
PID:4488 -
\??\c:\htbtnh.exec:\htbtnh.exe48⤵
- Executes dropped EXE
PID:5080 -
\??\c:\ttbnhb.exec:\ttbnhb.exe49⤵
- Executes dropped EXE
PID:1296 -
\??\c:\dppjv.exec:\dppjv.exe50⤵
- Executes dropped EXE
PID:1160 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe51⤵
- Executes dropped EXE
PID:1860 -
\??\c:\lffxrff.exec:\lffxrff.exe52⤵
- Executes dropped EXE
PID:3604 -
\??\c:\3ntnhh.exec:\3ntnhh.exe53⤵
- Executes dropped EXE
PID:3228 -
\??\c:\ddddv.exec:\ddddv.exe54⤵
- Executes dropped EXE
PID:4316 -
\??\c:\9pjdj.exec:\9pjdj.exe55⤵
- Executes dropped EXE
PID:1376 -
\??\c:\7llfxfx.exec:\7llfxfx.exe56⤵
- Executes dropped EXE
PID:4872 -
\??\c:\bbhhhh.exec:\bbhhhh.exe57⤵
- Executes dropped EXE
PID:2420 -
\??\c:\7pjdv.exec:\7pjdv.exe58⤵
- Executes dropped EXE
PID:1964 -
\??\c:\rfffxxx.exec:\rfffxxx.exe59⤵
- Executes dropped EXE
PID:4584 -
\??\c:\lfrlrlr.exec:\lfrlrlr.exe60⤵
- Executes dropped EXE
PID:5000 -
\??\c:\hhthtn.exec:\hhthtn.exe61⤵
- Executes dropped EXE
PID:1440 -
\??\c:\djjdd.exec:\djjdd.exe62⤵
- Executes dropped EXE
PID:3056 -
\??\c:\nbbhbb.exec:\nbbhbb.exe63⤵
- Executes dropped EXE
PID:4448 -
\??\c:\vpdjd.exec:\vpdjd.exe64⤵
- Executes dropped EXE
PID:3248 -
\??\c:\bttnnh.exec:\bttnnh.exe65⤵
- Executes dropped EXE
PID:3120 -
\??\c:\vjpjv.exec:\vjpjv.exe66⤵PID:4780
-
\??\c:\rrfxrrr.exec:\rrfxrrr.exe67⤵PID:4540
-
\??\c:\bbhhbb.exec:\bbhhbb.exe68⤵PID:3036
-
\??\c:\pvvjv.exec:\pvvjv.exe69⤵PID:3752
-
\??\c:\htthnn.exec:\htthnn.exe70⤵PID:4208
-
\??\c:\vdjjj.exec:\vdjjj.exe71⤵PID:5056
-
\??\c:\fxrlllf.exec:\fxrlllf.exe72⤵
- System Location Discovery: System Language Discovery
PID:1080 -
\??\c:\bbhtnn.exec:\bbhtnn.exe73⤵PID:1828
-
\??\c:\vdpvv.exec:\vdpvv.exe74⤵PID:4868
-
\??\c:\btbthh.exec:\btbthh.exe75⤵PID:4988
-
\??\c:\hhhbnn.exec:\hhhbnn.exe76⤵PID:2668
-
\??\c:\djjvj.exec:\djjvj.exe77⤵PID:4040
-
\??\c:\3bhbbt.exec:\3bhbbt.exe78⤵PID:956
-
\??\c:\dvvpj.exec:\dvvpj.exe79⤵PID:696
-
\??\c:\rllfrrl.exec:\rllfrrl.exe80⤵PID:3764
-
\??\c:\9xlfxxr.exec:\9xlfxxr.exe81⤵PID:4900
-
\??\c:\7nnhht.exec:\7nnhht.exe82⤵PID:2380
-
\??\c:\pjjdj.exec:\pjjdj.exe83⤵PID:5032
-
\??\c:\5lrrlff.exec:\5lrrlff.exe84⤵PID:2816
-
\??\c:\rrfxrlf.exec:\rrfxrlf.exe85⤵PID:2824
-
\??\c:\9htttt.exec:\9htttt.exe86⤵PID:3888
-
\??\c:\pdjdv.exec:\pdjdv.exe87⤵PID:1900
-
\??\c:\pjdvj.exec:\pjdvj.exe88⤵
- System Location Discovery: System Language Discovery
PID:4752 -
\??\c:\bbbntb.exec:\bbbntb.exe89⤵PID:584
-
\??\c:\9bhtnn.exec:\9bhtnn.exe90⤵PID:3208
-
\??\c:\vvjjj.exec:\vvjjj.exe91⤵PID:4524
-
\??\c:\xllxlfx.exec:\xllxlfx.exe92⤵PID:5020
-
\??\c:\tnntnn.exec:\tnntnn.exe93⤵PID:4812
-
\??\c:\thnhtt.exec:\thnhtt.exe94⤵PID:3416
-
\??\c:\jpdvj.exec:\jpdvj.exe95⤵PID:3264
-
\??\c:\xllffff.exec:\xllffff.exe96⤵PID:4700
-
\??\c:\5ttbtn.exec:\5ttbtn.exe97⤵PID:4416
-
\??\c:\dvvpj.exec:\dvvpj.exe98⤵PID:1708
-
\??\c:\vvddp.exec:\vvddp.exe99⤵PID:404
-
\??\c:\flrlfff.exec:\flrlfff.exe100⤵PID:3688
-
\??\c:\7nthbn.exec:\7nthbn.exe101⤵PID:2052
-
\??\c:\ppjdv.exec:\ppjdv.exe102⤵PID:724
-
\??\c:\9jjdv.exec:\9jjdv.exe103⤵PID:3680
-
\??\c:\3lrfffx.exec:\3lrfffx.exe104⤵PID:964
-
\??\c:\nnnnbb.exec:\nnnnbb.exe105⤵PID:3428
-
\??\c:\5tbthh.exec:\5tbthh.exe106⤵PID:4012
-
\??\c:\pdpdv.exec:\pdpdv.exe107⤵PID:2056
-
\??\c:\lxrfrlx.exec:\lxrfrlx.exe108⤵PID:1776
-
\??\c:\7htntn.exec:\7htntn.exe109⤵PID:2608
-
\??\c:\nbbhtt.exec:\nbbhtt.exe110⤵PID:2288
-
\??\c:\3pjvd.exec:\3pjvd.exe111⤵PID:1376
-
\??\c:\9frlxxr.exec:\9frlxxr.exe112⤵PID:3296
-
\??\c:\hbthtt.exec:\hbthtt.exe113⤵PID:1096
-
\??\c:\pjjjv.exec:\pjjjv.exe114⤵PID:4360
-
\??\c:\ppvpj.exec:\ppvpj.exe115⤵PID:3276
-
\??\c:\xxfrffr.exec:\xxfrffr.exe116⤵PID:4696
-
\??\c:\fllfxrf.exec:\fllfxrf.exe117⤵PID:3956
-
\??\c:\bnnbtn.exec:\bnnbtn.exe118⤵PID:4080
-
\??\c:\fxxfxrf.exec:\fxxfxrf.exe119⤵PID:4356
-
\??\c:\lrxxllx.exec:\lrxxllx.exe120⤵PID:2004
-
\??\c:\bhhbnb.exec:\bhhbnb.exe121⤵PID:2064
-
\??\c:\ddjvd.exec:\ddjvd.exe122⤵PID:2484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-