Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 05:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6449e9989cc3fea5a817abb9813623eff304880dc38a1e554ebac236dc6f6031.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
6449e9989cc3fea5a817abb9813623eff304880dc38a1e554ebac236dc6f6031.exe
-
Size
454KB
-
MD5
5f1c686ecbf639a559a52de5a75e8db4
-
SHA1
3f0d45b8ec59bccf352fda218d128593e09da8f8
-
SHA256
6449e9989cc3fea5a817abb9813623eff304880dc38a1e554ebac236dc6f6031
-
SHA512
eb9395e76ac1cb0c6359eb84fb518b6c397904a14a7bdc03d5ec16b4049190e474eecb2c0737febc39c5e945720b0a01da84bb35e86644c9b42f995d3c3ce012
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet+:q7Tc2NYHUrAwfMp3CDt+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3096-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2100-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1136-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/680-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3828-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3416-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1572-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2712-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1108-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/964-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1208-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1676-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1396-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2780-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/932-620-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-624-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-689-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1300-834-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-838-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-863-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-1141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-1223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3512 nbhhbb.exe 1692 rxrllff.exe 2520 rlxxffr.exe 1476 hnbtnh.exe 456 fflfxrl.exe 1376 jddvv.exe 3308 jdjdj.exe 1548 jdjpj.exe 3808 nthbtt.exe 1872 vjjjd.exe 2100 nhhtnh.exe 1444 jdjdd.exe 1776 5flxrrl.exe 2616 5hbnhb.exe 2336 tbbtnh.exe 1136 fxxrxxf.exe 2224 ffrlxxx.exe 1980 pdjjj.exe 2236 xlxlfxr.exe 2420 ttbtnh.exe 1080 ntbnhn.exe 2524 dvvjv.exe 680 fflflfx.exe 5076 dvpjd.exe 3828 dpddd.exe 5020 tbhbtn.exe 2068 lffxrlf.exe 3000 nhnbtt.exe 2244 rlxxxxr.exe 4752 jpddp.exe 3816 xfrfxxr.exe 208 nbbtnn.exe 1076 fxlxlfx.exe 3276 nntnbb.exe 860 3vjvj.exe 1684 lxlfrll.exe 5028 hbnhnh.exe 5080 5jpdp.exe 4420 dpvpj.exe 740 3xfrlfx.exe 536 nnthtt.exe 4964 btbhnh.exe 3200 pdpdd.exe 3888 7fxrfxr.exe 4468 httbnn.exe 4644 htnbnt.exe 832 vjjpd.exe 2340 1fxrxfr.exe 4344 frrfxrl.exe 3416 nnnbnh.exe 3572 jvpjp.exe 3348 xffxrll.exe 4520 9bhbtt.exe 4496 vdpjv.exe 1572 pvddp.exe 1192 fffrffr.exe 3184 bnhthb.exe 868 dppjv.exe 4880 lflfxxx.exe 216 lrxrrlf.exe 2712 bnntnh.exe 3008 5djdp.exe 5044 rllfxrf.exe 4292 5nnhbn.exe -
resource yara_rule behavioral2/memory/3096-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2100-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2616-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1136-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2224-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/680-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3828-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3416-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1572-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2712-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1108-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/964-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1676-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1396-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2780-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/932-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1300-834-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-838-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-863-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxlxrr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3096 wrote to memory of 3512 3096 6449e9989cc3fea5a817abb9813623eff304880dc38a1e554ebac236dc6f6031.exe 82 PID 3096 wrote to memory of 3512 3096 6449e9989cc3fea5a817abb9813623eff304880dc38a1e554ebac236dc6f6031.exe 82 PID 3096 wrote to memory of 3512 3096 6449e9989cc3fea5a817abb9813623eff304880dc38a1e554ebac236dc6f6031.exe 82 PID 3512 wrote to memory of 1692 3512 nbhhbb.exe 83 PID 3512 wrote to memory of 1692 3512 nbhhbb.exe 83 PID 3512 wrote to memory of 1692 3512 nbhhbb.exe 83 PID 1692 wrote to memory of 2520 1692 rxrllff.exe 84 PID 1692 wrote to memory of 2520 1692 rxrllff.exe 84 PID 1692 wrote to memory of 2520 1692 rxrllff.exe 84 PID 2520 wrote to memory of 1476 2520 rlxxffr.exe 85 PID 2520 wrote to memory of 1476 2520 rlxxffr.exe 85 PID 2520 wrote to memory of 1476 2520 rlxxffr.exe 85 PID 1476 wrote to memory of 456 1476 hnbtnh.exe 86 PID 1476 wrote to memory of 456 1476 hnbtnh.exe 86 PID 1476 wrote to memory of 456 1476 hnbtnh.exe 86 PID 456 wrote to memory of 1376 456 fflfxrl.exe 87 PID 456 wrote to memory of 1376 456 fflfxrl.exe 87 PID 456 wrote to memory of 1376 456 fflfxrl.exe 87 PID 1376 wrote to memory of 3308 1376 jddvv.exe 88 PID 1376 wrote to memory of 3308 1376 jddvv.exe 88 PID 1376 wrote to memory of 3308 1376 jddvv.exe 88 PID 3308 wrote to memory of 1548 3308 jdjdj.exe 89 PID 3308 wrote to memory of 1548 3308 jdjdj.exe 89 PID 3308 wrote to memory of 1548 3308 jdjdj.exe 89 PID 1548 wrote to memory of 3808 1548 jdjpj.exe 90 PID 1548 wrote to memory of 3808 1548 jdjpj.exe 90 PID 1548 wrote to memory of 3808 1548 jdjpj.exe 90 PID 3808 wrote to memory of 1872 3808 nthbtt.exe 91 PID 3808 wrote to memory of 1872 3808 nthbtt.exe 91 PID 3808 wrote to memory of 1872 3808 nthbtt.exe 91 PID 1872 wrote to memory of 2100 1872 vjjjd.exe 92 PID 1872 wrote to memory of 2100 1872 vjjjd.exe 92 PID 1872 wrote to memory of 2100 1872 vjjjd.exe 92 PID 2100 wrote to memory of 1444 2100 nhhtnh.exe 93 PID 2100 wrote to memory of 1444 2100 nhhtnh.exe 93 PID 2100 wrote to memory of 1444 2100 nhhtnh.exe 93 PID 1444 wrote to memory of 1776 1444 jdjdd.exe 94 PID 1444 wrote to memory of 1776 1444 jdjdd.exe 94 PID 1444 wrote to memory of 1776 1444 jdjdd.exe 94 PID 1776 wrote to memory of 2616 1776 5flxrrl.exe 95 PID 1776 wrote to memory of 2616 1776 5flxrrl.exe 95 PID 1776 wrote to memory of 2616 1776 5flxrrl.exe 95 PID 2616 wrote to memory of 2336 2616 5hbnhb.exe 96 PID 2616 wrote to memory of 2336 2616 5hbnhb.exe 96 PID 2616 wrote to memory of 2336 2616 5hbnhb.exe 96 PID 2336 wrote to memory of 1136 2336 tbbtnh.exe 97 PID 2336 wrote to memory of 1136 2336 tbbtnh.exe 97 PID 2336 wrote to memory of 1136 2336 tbbtnh.exe 97 PID 1136 wrote to memory of 2224 1136 fxxrxxf.exe 98 PID 1136 wrote to memory of 2224 1136 fxxrxxf.exe 98 PID 1136 wrote to memory of 2224 1136 fxxrxxf.exe 98 PID 2224 wrote to memory of 1980 2224 ffrlxxx.exe 99 PID 2224 wrote to memory of 1980 2224 ffrlxxx.exe 99 PID 2224 wrote to memory of 1980 2224 ffrlxxx.exe 99 PID 1980 wrote to memory of 2236 1980 pdjjj.exe 100 PID 1980 wrote to memory of 2236 1980 pdjjj.exe 100 PID 1980 wrote to memory of 2236 1980 pdjjj.exe 100 PID 2236 wrote to memory of 2420 2236 xlxlfxr.exe 101 PID 2236 wrote to memory of 2420 2236 xlxlfxr.exe 101 PID 2236 wrote to memory of 2420 2236 xlxlfxr.exe 101 PID 2420 wrote to memory of 1080 2420 ttbtnh.exe 102 PID 2420 wrote to memory of 1080 2420 ttbtnh.exe 102 PID 2420 wrote to memory of 1080 2420 ttbtnh.exe 102 PID 1080 wrote to memory of 2524 1080 ntbnhn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\6449e9989cc3fea5a817abb9813623eff304880dc38a1e554ebac236dc6f6031.exe"C:\Users\Admin\AppData\Local\Temp\6449e9989cc3fea5a817abb9813623eff304880dc38a1e554ebac236dc6f6031.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\nbhhbb.exec:\nbhhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\rxrllff.exec:\rxrllff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\rlxxffr.exec:\rlxxffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\hnbtnh.exec:\hnbtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\fflfxrl.exec:\fflfxrl.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\jddvv.exec:\jddvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\jdjdj.exec:\jdjdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\jdjpj.exec:\jdjpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\nthbtt.exec:\nthbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\vjjjd.exec:\vjjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\nhhtnh.exec:\nhhtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\jdjdd.exec:\jdjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\5flxrrl.exec:\5flxrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\5hbnhb.exec:\5hbnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\tbbtnh.exec:\tbbtnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\fxxrxxf.exec:\fxxrxxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\ffrlxxx.exec:\ffrlxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\pdjjj.exec:\pdjjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\xlxlfxr.exec:\xlxlfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\ttbtnh.exec:\ttbtnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\ntbnhn.exec:\ntbnhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\dvvjv.exec:\dvvjv.exe23⤵
- Executes dropped EXE
PID:2524 -
\??\c:\fflflfx.exec:\fflflfx.exe24⤵
- Executes dropped EXE
PID:680 -
\??\c:\dvpjd.exec:\dvpjd.exe25⤵
- Executes dropped EXE
PID:5076 -
\??\c:\dpddd.exec:\dpddd.exe26⤵
- Executes dropped EXE
PID:3828 -
\??\c:\tbhbtn.exec:\tbhbtn.exe27⤵
- Executes dropped EXE
PID:5020 -
\??\c:\lffxrlf.exec:\lffxrlf.exe28⤵
- Executes dropped EXE
PID:2068 -
\??\c:\nhnbtt.exec:\nhnbtt.exe29⤵
- Executes dropped EXE
PID:3000 -
\??\c:\rlxxxxr.exec:\rlxxxxr.exe30⤵
- Executes dropped EXE
PID:2244 -
\??\c:\jpddp.exec:\jpddp.exe31⤵
- Executes dropped EXE
PID:4752 -
\??\c:\xfrfxxr.exec:\xfrfxxr.exe32⤵
- Executes dropped EXE
PID:3816 -
\??\c:\nbbtnn.exec:\nbbtnn.exe33⤵
- Executes dropped EXE
PID:208 -
\??\c:\fxlxlfx.exec:\fxlxlfx.exe34⤵
- Executes dropped EXE
PID:1076 -
\??\c:\nntnbb.exec:\nntnbb.exe35⤵
- Executes dropped EXE
PID:3276 -
\??\c:\3vjvj.exec:\3vjvj.exe36⤵
- Executes dropped EXE
PID:860 -
\??\c:\lxlfrll.exec:\lxlfrll.exe37⤵
- Executes dropped EXE
PID:1684 -
\??\c:\hbnhnh.exec:\hbnhnh.exe38⤵
- Executes dropped EXE
PID:5028 -
\??\c:\5jpdp.exec:\5jpdp.exe39⤵
- Executes dropped EXE
PID:5080 -
\??\c:\dpvpj.exec:\dpvpj.exe40⤵
- Executes dropped EXE
PID:4420 -
\??\c:\3xfrlfx.exec:\3xfrlfx.exe41⤵
- Executes dropped EXE
PID:740 -
\??\c:\nnthtt.exec:\nnthtt.exe42⤵
- Executes dropped EXE
PID:536 -
\??\c:\btbhnh.exec:\btbhnh.exe43⤵
- Executes dropped EXE
PID:4964 -
\??\c:\pdpdd.exec:\pdpdd.exe44⤵
- Executes dropped EXE
PID:3200 -
\??\c:\7fxrfxr.exec:\7fxrfxr.exe45⤵
- Executes dropped EXE
PID:3888 -
\??\c:\httbnn.exec:\httbnn.exe46⤵
- Executes dropped EXE
PID:4468 -
\??\c:\htnbnt.exec:\htnbnt.exe47⤵
- Executes dropped EXE
PID:4644 -
\??\c:\vjjpd.exec:\vjjpd.exe48⤵
- Executes dropped EXE
PID:832 -
\??\c:\1fxrxfr.exec:\1fxrxfr.exe49⤵
- Executes dropped EXE
PID:2340 -
\??\c:\frrfxrl.exec:\frrfxrl.exe50⤵
- Executes dropped EXE
PID:4344 -
\??\c:\nnnbnh.exec:\nnnbnh.exe51⤵
- Executes dropped EXE
PID:3416 -
\??\c:\jvpjp.exec:\jvpjp.exe52⤵
- Executes dropped EXE
PID:3572 -
\??\c:\xffxrll.exec:\xffxrll.exe53⤵
- Executes dropped EXE
PID:3348 -
\??\c:\9bhbtt.exec:\9bhbtt.exe54⤵
- Executes dropped EXE
PID:4520 -
\??\c:\vdpjv.exec:\vdpjv.exe55⤵
- Executes dropped EXE
PID:4496 -
\??\c:\pvddp.exec:\pvddp.exe56⤵
- Executes dropped EXE
PID:1572 -
\??\c:\fffrffr.exec:\fffrffr.exe57⤵
- Executes dropped EXE
PID:1192 -
\??\c:\bnhthb.exec:\bnhthb.exe58⤵
- Executes dropped EXE
PID:3184 -
\??\c:\dppjv.exec:\dppjv.exe59⤵
- Executes dropped EXE
PID:868 -
\??\c:\lflfxxx.exec:\lflfxxx.exe60⤵
- Executes dropped EXE
PID:4880 -
\??\c:\lrxrrlf.exec:\lrxrrlf.exe61⤵
- Executes dropped EXE
PID:216 -
\??\c:\bnntnh.exec:\bnntnh.exe62⤵
- Executes dropped EXE
PID:2712 -
\??\c:\5djdp.exec:\5djdp.exe63⤵
- Executes dropped EXE
PID:3008 -
\??\c:\rllfxrf.exec:\rllfxrf.exe64⤵
- Executes dropped EXE
PID:5044 -
\??\c:\5nnhbn.exec:\5nnhbn.exe65⤵
- Executes dropped EXE
PID:4292 -
\??\c:\bntnbb.exec:\bntnbb.exe66⤵PID:1108
-
\??\c:\djpjp.exec:\djpjp.exe67⤵PID:1548
-
\??\c:\rxllffx.exec:\rxllffx.exe68⤵PID:4632
-
\??\c:\hhhhbb.exec:\hhhhbb.exe69⤵PID:2116
-
\??\c:\ddjdv.exec:\ddjdv.exe70⤵PID:2884
-
\??\c:\3nhbtt.exec:\3nhbtt.exe71⤵PID:2100
-
\??\c:\vjpjd.exec:\vjpjd.exe72⤵PID:964
-
\??\c:\pdvpp.exec:\pdvpp.exe73⤵PID:592
-
\??\c:\flxrlfr.exec:\flxrlfr.exe74⤵PID:3012
-
\??\c:\1hthbt.exec:\1hthbt.exe75⤵PID:3812
-
\??\c:\vppdv.exec:\vppdv.exe76⤵PID:1208
-
\??\c:\rfxlxrl.exec:\rfxlxrl.exe77⤵PID:3872
-
\??\c:\fxffffl.exec:\fxffffl.exe78⤵PID:4424
-
\??\c:\tnnbhb.exec:\tnnbhb.exe79⤵PID:2948
-
\??\c:\dvpdp.exec:\dvpdp.exe80⤵PID:4884
-
\??\c:\xrxlrrr.exec:\xrxlrrr.exe81⤵PID:1636
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe82⤵PID:4832
-
\??\c:\3hhhtt.exec:\3hhhtt.exe83⤵PID:1268
-
\??\c:\1pvjd.exec:\1pvjd.exe84⤵PID:1732
-
\??\c:\rxxrfxr.exec:\rxxrfxr.exe85⤵PID:2052
-
\??\c:\tnhhnh.exec:\tnhhnh.exe86⤵PID:2796
-
\??\c:\btbthb.exec:\btbthb.exe87⤵PID:2740
-
\??\c:\pddvj.exec:\pddvj.exe88⤵PID:2792
-
\??\c:\7rxrlll.exec:\7rxrlll.exe89⤵PID:1752
-
\??\c:\nhtntt.exec:\nhtntt.exe90⤵PID:2372
-
\??\c:\ddpjd.exec:\ddpjd.exe91⤵PID:1676
-
\??\c:\vvdjj.exec:\vvdjj.exe92⤵PID:4048
-
\??\c:\thbtbb.exec:\thbtbb.exe93⤵PID:2968
-
\??\c:\nbhbhh.exec:\nbhbhh.exe94⤵PID:5092
-
\??\c:\pjjdv.exec:\pjjdv.exe95⤵PID:4000
-
\??\c:\rxfxxll.exec:\rxfxxll.exe96⤵PID:1640
-
\??\c:\7xrlrrx.exec:\7xrlrrx.exe97⤵PID:4828
-
\??\c:\bhnhhh.exec:\bhnhhh.exe98⤵
- System Location Discovery: System Language Discovery
PID:3284 -
\??\c:\vjvjd.exec:\vjvjd.exe99⤵PID:3168
-
\??\c:\jdpjd.exec:\jdpjd.exe100⤵PID:5004
-
\??\c:\lxfxlfx.exec:\lxfxlfx.exe101⤵PID:1976
-
\??\c:\hhhhhh.exec:\hhhhhh.exe102⤵PID:1688
-
\??\c:\7dvvj.exec:\7dvvj.exe103⤵PID:1748
-
\??\c:\pdpjv.exec:\pdpjv.exe104⤵PID:2848
-
\??\c:\nbhnbb.exec:\nbhnbb.exe105⤵PID:4780
-
\??\c:\1ttthh.exec:\1ttthh.exe106⤵PID:5080
-
\??\c:\jpvvp.exec:\jpvvp.exe107⤵PID:4420
-
\??\c:\lxrfxxr.exec:\lxrfxxr.exe108⤵PID:740
-
\??\c:\lflfxxx.exec:\lflfxxx.exe109⤵PID:4628
-
\??\c:\7htnhh.exec:\7htnhh.exe110⤵PID:432
-
\??\c:\dvddj.exec:\dvddj.exe111⤵
- System Location Discovery: System Language Discovery
PID:3200 -
\??\c:\lfxrfxr.exec:\lfxrfxr.exe112⤵PID:3888
-
\??\c:\nhhbtn.exec:\nhhbtn.exe113⤵PID:4584
-
\??\c:\jdjdv.exec:\jdjdv.exe114⤵PID:1132
-
\??\c:\xllrfxl.exec:\xllrfxl.exe115⤵PID:2824
-
\??\c:\rlrllfr.exec:\rlrllfr.exe116⤵PID:4588
-
\??\c:\nhnhnh.exec:\nhnhnh.exe117⤵PID:4344
-
\??\c:\jdjdv.exec:\jdjdv.exe118⤵PID:2368
-
\??\c:\3pdpd.exec:\3pdpd.exe119⤵PID:3572
-
\??\c:\rfrllfl.exec:\rfrllfl.exe120⤵PID:4524
-
\??\c:\bthbbb.exec:\bthbbb.exe121⤵PID:4668
-
\??\c:\dvpjv.exec:\dvpjv.exe122⤵PID:1072
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-