Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 05:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
15bf6a2aea91152e7628d02c2cb60344c355894232f4073c70beb3440d36c978.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
15bf6a2aea91152e7628d02c2cb60344c355894232f4073c70beb3440d36c978.exe
-
Size
456KB
-
MD5
627aa7a5f1f15e7a6322745971081fe4
-
SHA1
5378db3a53eb41924351ccc8d221da1e0086da50
-
SHA256
15bf6a2aea91152e7628d02c2cb60344c355894232f4073c70beb3440d36c978
-
SHA512
178493b59d9e5ee30bcfd3e14470882e1989dd3b659f2e7e5112fdb2f9f8809b7ea08391b4a5ce25314e46e43ef7eeaf2293a128fa28bb7ea511375900155afd
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRF:q7Tc2NYHUrAwfMp3CDRF
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2228-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3816-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/888-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/884-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4272-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1588-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1912-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4068-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3296-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/864-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2664-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1768-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/792-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-664-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3792-680-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-1003-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4196-1267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3060 3pjpj.exe 2816 lxxxrrr.exe 4968 hbbhht.exe 4048 btnbtn.exe 4484 frrllff.exe 4288 1djdd.exe 1452 fxxfxrx.exe 4908 jvpvd.exe 4980 jddpj.exe 1376 nbnttn.exe 4992 llfxllf.exe 3816 nhhhtt.exe 888 vvddp.exe 2352 tnnhtn.exe 4268 hhbtnh.exe 2416 nbbttn.exe 4056 1hbthh.exe 884 rlfxfxx.exe 3528 nhnhnn.exe 5052 rrxrfxr.exe 1660 1bnbnn.exe 1844 rfflffx.exe 3772 bnnhbb.exe 3524 jdpjj.exe 1488 1jppd.exe 3020 rxlxfxr.exe 1036 hnnhbb.exe 1168 pddpj.exe 2320 5xxlxxr.exe 4272 hbtnbt.exe 1588 3djdv.exe 448 xxllxfl.exe 3268 pvddv.exe 4540 rllfrrl.exe 4568 jddjv.exe 5008 vpdpp.exe 4740 lflfxrx.exe 2124 bhnnbb.exe 2336 djvdp.exe 4496 frrxrfl.exe 1108 xlrlffx.exe 3208 hbtnbn.exe 3644 dvpjd.exe 1912 rxxlxrf.exe 1380 thbnbt.exe 4316 pdvpv.exe 3060 xllrffx.exe 2396 lflfxxr.exe 1144 httnth.exe 2448 1pvpj.exe 4552 fffxrrl.exe 3760 bhtnbt.exe 4904 vjjvp.exe 4068 7djdp.exe 4240 rlfxlfx.exe 1652 9tthbt.exe 3296 9pvpv.exe 3712 1flrfxl.exe 1704 ntbthh.exe 4236 nbhtnh.exe 1376 9djdj.exe 2740 lxxrlfx.exe 2528 1bnnbb.exe 1104 hnnbhb.exe -
resource yara_rule behavioral2/memory/2228-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3816-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/888-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/884-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4272-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1912-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4068-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2664-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1768-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/792-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-664-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ththtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2228 wrote to memory of 3060 2228 15bf6a2aea91152e7628d02c2cb60344c355894232f4073c70beb3440d36c978.exe 82 PID 2228 wrote to memory of 3060 2228 15bf6a2aea91152e7628d02c2cb60344c355894232f4073c70beb3440d36c978.exe 82 PID 2228 wrote to memory of 3060 2228 15bf6a2aea91152e7628d02c2cb60344c355894232f4073c70beb3440d36c978.exe 82 PID 3060 wrote to memory of 2816 3060 3pjpj.exe 83 PID 3060 wrote to memory of 2816 3060 3pjpj.exe 83 PID 3060 wrote to memory of 2816 3060 3pjpj.exe 83 PID 2816 wrote to memory of 4968 2816 lxxxrrr.exe 84 PID 2816 wrote to memory of 4968 2816 lxxxrrr.exe 84 PID 2816 wrote to memory of 4968 2816 lxxxrrr.exe 84 PID 4968 wrote to memory of 4048 4968 hbbhht.exe 85 PID 4968 wrote to memory of 4048 4968 hbbhht.exe 85 PID 4968 wrote to memory of 4048 4968 hbbhht.exe 85 PID 4048 wrote to memory of 4484 4048 btnbtn.exe 86 PID 4048 wrote to memory of 4484 4048 btnbtn.exe 86 PID 4048 wrote to memory of 4484 4048 btnbtn.exe 86 PID 4484 wrote to memory of 4288 4484 frrllff.exe 87 PID 4484 wrote to memory of 4288 4484 frrllff.exe 87 PID 4484 wrote to memory of 4288 4484 frrllff.exe 87 PID 4288 wrote to memory of 1452 4288 1djdd.exe 88 PID 4288 wrote to memory of 1452 4288 1djdd.exe 88 PID 4288 wrote to memory of 1452 4288 1djdd.exe 88 PID 1452 wrote to memory of 4908 1452 fxxfxrx.exe 89 PID 1452 wrote to memory of 4908 1452 fxxfxrx.exe 89 PID 1452 wrote to memory of 4908 1452 fxxfxrx.exe 89 PID 4908 wrote to memory of 4980 4908 jvpvd.exe 90 PID 4908 wrote to memory of 4980 4908 jvpvd.exe 90 PID 4908 wrote to memory of 4980 4908 jvpvd.exe 90 PID 4980 wrote to memory of 1376 4980 jddpj.exe 91 PID 4980 wrote to memory of 1376 4980 jddpj.exe 91 PID 4980 wrote to memory of 1376 4980 jddpj.exe 91 PID 1376 wrote to memory of 4992 1376 nbnttn.exe 92 PID 1376 wrote to memory of 4992 1376 nbnttn.exe 92 PID 1376 wrote to memory of 4992 1376 nbnttn.exe 92 PID 4992 wrote to memory of 3816 4992 llfxllf.exe 93 PID 4992 wrote to memory of 3816 4992 llfxllf.exe 93 PID 4992 wrote to memory of 3816 4992 llfxllf.exe 93 PID 3816 wrote to memory of 888 3816 nhhhtt.exe 94 PID 3816 wrote to memory of 888 3816 nhhhtt.exe 94 PID 3816 wrote to memory of 888 3816 nhhhtt.exe 94 PID 888 wrote to memory of 2352 888 vvddp.exe 95 PID 888 wrote to memory of 2352 888 vvddp.exe 95 PID 888 wrote to memory of 2352 888 vvddp.exe 95 PID 2352 wrote to memory of 4268 2352 tnnhtn.exe 96 PID 2352 wrote to memory of 4268 2352 tnnhtn.exe 96 PID 2352 wrote to memory of 4268 2352 tnnhtn.exe 96 PID 4268 wrote to memory of 2416 4268 hhbtnh.exe 97 PID 4268 wrote to memory of 2416 4268 hhbtnh.exe 97 PID 4268 wrote to memory of 2416 4268 hhbtnh.exe 97 PID 2416 wrote to memory of 4056 2416 nbbttn.exe 98 PID 2416 wrote to memory of 4056 2416 nbbttn.exe 98 PID 2416 wrote to memory of 4056 2416 nbbttn.exe 98 PID 4056 wrote to memory of 884 4056 1hbthh.exe 99 PID 4056 wrote to memory of 884 4056 1hbthh.exe 99 PID 4056 wrote to memory of 884 4056 1hbthh.exe 99 PID 884 wrote to memory of 3528 884 rlfxfxx.exe 100 PID 884 wrote to memory of 3528 884 rlfxfxx.exe 100 PID 884 wrote to memory of 3528 884 rlfxfxx.exe 100 PID 3528 wrote to memory of 5052 3528 nhnhnn.exe 101 PID 3528 wrote to memory of 5052 3528 nhnhnn.exe 101 PID 3528 wrote to memory of 5052 3528 nhnhnn.exe 101 PID 5052 wrote to memory of 1660 5052 rrxrfxr.exe 102 PID 5052 wrote to memory of 1660 5052 rrxrfxr.exe 102 PID 5052 wrote to memory of 1660 5052 rrxrfxr.exe 102 PID 1660 wrote to memory of 1844 1660 1bnbnn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\15bf6a2aea91152e7628d02c2cb60344c355894232f4073c70beb3440d36c978.exe"C:\Users\Admin\AppData\Local\Temp\15bf6a2aea91152e7628d02c2cb60344c355894232f4073c70beb3440d36c978.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\3pjpj.exec:\3pjpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\hbbhht.exec:\hbbhht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\btnbtn.exec:\btnbtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\frrllff.exec:\frrllff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\1djdd.exec:\1djdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\fxxfxrx.exec:\fxxfxrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\jvpvd.exec:\jvpvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\jddpj.exec:\jddpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\nbnttn.exec:\nbnttn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\llfxllf.exec:\llfxllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\nhhhtt.exec:\nhhhtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\vvddp.exec:\vvddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\tnnhtn.exec:\tnnhtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\hhbtnh.exec:\hhbtnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\nbbttn.exec:\nbbttn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\1hbthh.exec:\1hbthh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\rlfxfxx.exec:\rlfxfxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\nhnhnn.exec:\nhnhnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\rrxrfxr.exec:\rrxrfxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\1bnbnn.exec:\1bnbnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\rfflffx.exec:\rfflffx.exe23⤵
- Executes dropped EXE
PID:1844 -
\??\c:\bnnhbb.exec:\bnnhbb.exe24⤵
- Executes dropped EXE
PID:3772 -
\??\c:\jdpjj.exec:\jdpjj.exe25⤵
- Executes dropped EXE
PID:3524 -
\??\c:\1jppd.exec:\1jppd.exe26⤵
- Executes dropped EXE
PID:1488 -
\??\c:\rxlxfxr.exec:\rxlxfxr.exe27⤵
- Executes dropped EXE
PID:3020 -
\??\c:\hnnhbb.exec:\hnnhbb.exe28⤵
- Executes dropped EXE
PID:1036 -
\??\c:\pddpj.exec:\pddpj.exe29⤵
- Executes dropped EXE
PID:1168 -
\??\c:\5xxlxxr.exec:\5xxlxxr.exe30⤵
- Executes dropped EXE
PID:2320 -
\??\c:\hbtnbt.exec:\hbtnbt.exe31⤵
- Executes dropped EXE
PID:4272 -
\??\c:\3djdv.exec:\3djdv.exe32⤵
- Executes dropped EXE
PID:1588 -
\??\c:\xxllxfl.exec:\xxllxfl.exe33⤵
- Executes dropped EXE
PID:448 -
\??\c:\pvddv.exec:\pvddv.exe34⤵
- Executes dropped EXE
PID:3268 -
\??\c:\rllfrrl.exec:\rllfrrl.exe35⤵
- Executes dropped EXE
PID:4540 -
\??\c:\jddjv.exec:\jddjv.exe36⤵
- Executes dropped EXE
PID:4568 -
\??\c:\vpdpp.exec:\vpdpp.exe37⤵
- Executes dropped EXE
PID:5008 -
\??\c:\lflfxrx.exec:\lflfxrx.exe38⤵
- Executes dropped EXE
PID:4740 -
\??\c:\bhnnbb.exec:\bhnnbb.exe39⤵
- Executes dropped EXE
PID:2124 -
\??\c:\djvdp.exec:\djvdp.exe40⤵
- Executes dropped EXE
PID:2336 -
\??\c:\frrxrfl.exec:\frrxrfl.exe41⤵
- Executes dropped EXE
PID:4496 -
\??\c:\xlrlffx.exec:\xlrlffx.exe42⤵
- Executes dropped EXE
PID:1108 -
\??\c:\hbtnbn.exec:\hbtnbn.exe43⤵
- Executes dropped EXE
PID:3208 -
\??\c:\dvpjd.exec:\dvpjd.exe44⤵
- Executes dropped EXE
PID:3644 -
\??\c:\rxxlxrf.exec:\rxxlxrf.exe45⤵
- Executes dropped EXE
PID:1912 -
\??\c:\thbnbt.exec:\thbnbt.exe46⤵
- Executes dropped EXE
PID:1380 -
\??\c:\pdvpv.exec:\pdvpv.exe47⤵
- Executes dropped EXE
PID:4316 -
\??\c:\xllrffx.exec:\xllrffx.exe48⤵
- Executes dropped EXE
PID:3060 -
\??\c:\lflfxxr.exec:\lflfxxr.exe49⤵
- Executes dropped EXE
PID:2396 -
\??\c:\httnth.exec:\httnth.exe50⤵
- Executes dropped EXE
PID:1144 -
\??\c:\1pvpj.exec:\1pvpj.exe51⤵
- Executes dropped EXE
PID:2448 -
\??\c:\fffxrrl.exec:\fffxrrl.exe52⤵
- Executes dropped EXE
PID:4552 -
\??\c:\bhtnbt.exec:\bhtnbt.exe53⤵
- Executes dropped EXE
PID:3760 -
\??\c:\vjjvp.exec:\vjjvp.exe54⤵
- Executes dropped EXE
PID:4904 -
\??\c:\7djdp.exec:\7djdp.exe55⤵
- Executes dropped EXE
PID:4068 -
\??\c:\rlfxlfx.exec:\rlfxlfx.exe56⤵
- Executes dropped EXE
PID:4240 -
\??\c:\9tthbt.exec:\9tthbt.exe57⤵
- Executes dropped EXE
PID:1652 -
\??\c:\9pvpv.exec:\9pvpv.exe58⤵
- Executes dropped EXE
PID:3296 -
\??\c:\1flrfxl.exec:\1flrfxl.exe59⤵
- Executes dropped EXE
PID:3712 -
\??\c:\ntbthh.exec:\ntbthh.exe60⤵
- Executes dropped EXE
PID:1704 -
\??\c:\nbhtnh.exec:\nbhtnh.exe61⤵
- Executes dropped EXE
PID:4236 -
\??\c:\9djdj.exec:\9djdj.exe62⤵
- Executes dropped EXE
PID:1376 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe63⤵
- Executes dropped EXE
PID:2740 -
\??\c:\1bnnbb.exec:\1bnnbb.exe64⤵
- Executes dropped EXE
PID:2528 -
\??\c:\hnnbhb.exec:\hnnbhb.exe65⤵
- Executes dropped EXE
PID:1104 -
\??\c:\pdvpj.exec:\pdvpj.exe66⤵PID:3204
-
\??\c:\lrfrxlx.exec:\lrfrxlx.exe67⤵PID:3436
-
\??\c:\bttnbt.exec:\bttnbt.exe68⤵PID:3852
-
\??\c:\btbntn.exec:\btbntn.exe69⤵PID:4924
-
\??\c:\vvvjp.exec:\vvvjp.exe70⤵PID:320
-
\??\c:\rlxxxxf.exec:\rlxxxxf.exe71⤵
- System Location Discovery: System Language Discovery
PID:4872 -
\??\c:\btnbnh.exec:\btnbnh.exe72⤵PID:3336
-
\??\c:\tbtbtb.exec:\tbtbtb.exe73⤵PID:884
-
\??\c:\jdvpd.exec:\jdvpd.exe74⤵PID:544
-
\??\c:\fffrxrf.exec:\fffrxrf.exe75⤵PID:2924
-
\??\c:\frllfxr.exec:\frllfxr.exe76⤵PID:4384
-
\??\c:\7nnbnn.exec:\7nnbnn.exe77⤵PID:4768
-
\??\c:\dvdvv.exec:\dvdvv.exe78⤵PID:1844
-
\??\c:\rrxlxrf.exec:\rrxlxrf.exe79⤵PID:4516
-
\??\c:\7llfxrl.exec:\7llfxrl.exe80⤵PID:212
-
\??\c:\nbhtnn.exec:\nbhtnn.exe81⤵PID:2060
-
\??\c:\dvjdv.exec:\dvjdv.exe82⤵PID:3324
-
\??\c:\rrlfrll.exec:\rrlfrll.exe83⤵PID:2512
-
\??\c:\hnnhtn.exec:\hnnhtn.exe84⤵PID:1036
-
\??\c:\bthhnn.exec:\bthhnn.exe85⤵PID:3620
-
\??\c:\9pjdv.exec:\9pjdv.exe86⤵PID:2308
-
\??\c:\ffxrflf.exec:\ffxrflf.exe87⤵PID:5108
-
\??\c:\lrfxrrl.exec:\lrfxrrl.exe88⤵PID:2280
-
\??\c:\nhhhnh.exec:\nhhhnh.exe89⤵PID:3316
-
\??\c:\jpjvd.exec:\jpjvd.exe90⤵PID:1588
-
\??\c:\jdjdv.exec:\jdjdv.exe91⤵PID:4972
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe92⤵PID:1976
-
\??\c:\9xfllll.exec:\9xfllll.exe93⤵PID:3264
-
\??\c:\3nttbt.exec:\3nttbt.exe94⤵PID:4540
-
\??\c:\ddpjv.exec:\ddpjv.exe95⤵PID:5044
-
\??\c:\xrrfrlf.exec:\xrrfrlf.exe96⤵PID:5008
-
\??\c:\9bnbhn.exec:\9bnbhn.exe97⤵PID:1448
-
\??\c:\thhhtt.exec:\thhhtt.exe98⤵PID:1560
-
\??\c:\jpjdj.exec:\jpjdj.exe99⤵PID:2688
-
\??\c:\9rfrffx.exec:\9rfrffx.exe100⤵PID:3812
-
\??\c:\bnhbht.exec:\bnhbht.exe101⤵PID:1780
-
\??\c:\tnntht.exec:\tnntht.exe102⤵PID:912
-
\??\c:\pjpdv.exec:\pjpdv.exe103⤵PID:4360
-
\??\c:\3fxrfxr.exec:\3fxrfxr.exe104⤵PID:3432
-
\??\c:\xllxrlf.exec:\xllxrlf.exe105⤵PID:3504
-
\??\c:\1bbtnh.exec:\1bbtnh.exe106⤵PID:4836
-
\??\c:\jvdpd.exec:\jvdpd.exe107⤵PID:4132
-
\??\c:\1llfrlf.exec:\1llfrlf.exe108⤵PID:3748
-
\??\c:\xfrlxxr.exec:\xfrlxxr.exe109⤵PID:4128
-
\??\c:\bnhbhh.exec:\bnhbhh.exe110⤵PID:1480
-
\??\c:\jddpd.exec:\jddpd.exe111⤵PID:2448
-
\??\c:\rlfxlfx.exec:\rlfxlfx.exe112⤵PID:4552
-
\??\c:\xrrffxx.exec:\xrrffxx.exe113⤵PID:3760
-
\??\c:\1bnthn.exec:\1bnthn.exe114⤵PID:4904
-
\??\c:\dpppd.exec:\dpppd.exe115⤵PID:864
-
\??\c:\7ppjv.exec:\7ppjv.exe116⤵PID:3776
-
\??\c:\3lfrxlx.exec:\3lfrxlx.exe117⤵PID:4908
-
\??\c:\hhtntt.exec:\hhtntt.exe118⤵PID:3296
-
\??\c:\jjvjp.exec:\jjvjp.exe119⤵PID:2660
-
\??\c:\7jjdp.exec:\7jjdp.exe120⤵PID:3624
-
\??\c:\7xxlfxf.exec:\7xxlfxf.exe121⤵PID:3660
-
\??\c:\ntbttt.exec:\ntbttt.exe122⤵PID:760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-