Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 07:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cfbc83ffa9963558fde2b2469389fabdcd8d81398cf245f1006ba2e2077b003fN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
cfbc83ffa9963558fde2b2469389fabdcd8d81398cf245f1006ba2e2077b003fN.exe
-
Size
454KB
-
MD5
8c4ab384aec4dc1a4469b69270bf6680
-
SHA1
86c84656a2229377c04da56d37261150c6fe48f9
-
SHA256
cfbc83ffa9963558fde2b2469389fabdcd8d81398cf245f1006ba2e2077b003f
-
SHA512
61410de44890130319ea4779a3f78796cd1756dd70e916a791c4b0600478c2edc4300b7754bf022b01a68ca7e01dd9d8875b84ebbbae791479f0ec72e2ebc3a5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3576-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2148-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1244-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3312-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/696-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/440-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/352-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1404-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1536-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3316-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3792-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1328-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2176-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4612-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3880-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-686-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-696-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-840-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-1219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1888 nbbtbb.exe 4640 rrffxxr.exe 4496 nbbbtt.exe 2148 9nnbbb.exe 2308 5dvpj.exe 1724 hbtntn.exe 64 dvvpj.exe 2264 tttbtt.exe 1244 xfxrllf.exe 4176 xxrlfll.exe 1980 9nnnhb.exe 3480 lxxxrrr.exe 2572 bbhhnn.exe 3312 djjdv.exe 4184 rflfxxr.exe 3152 xxflrrl.exe 4424 jjppv.exe 440 xrxffxx.exe 696 tbtnhh.exe 2920 ddddv.exe 1104 nhhtnn.exe 1544 vvpjd.exe 2480 7frllrl.exe 1804 7nnnhh.exe 3724 xxxfxrr.exe 1480 pjpjd.exe 1808 1rlfllf.exe 352 bbbttn.exe 2388 xfxffrl.exe 3672 frxflxf.exe 868 bthtbt.exe 1876 jdvjj.exe 4688 xxxllff.exe 1676 vjdpd.exe 3248 9xfxllx.exe 1052 btnbbt.exe 2824 jddvv.exe 1780 5flxlfx.exe 4156 btnbnh.exe 1040 tntnhb.exe 1404 pppdv.exe 4536 xrlxlfr.exe 1824 tnnhbt.exe 1536 djpjd.exe 4768 fxlrfxl.exe 3700 nhbhnh.exe 2576 htnnbb.exe 5056 9djdv.exe 3208 rffxxxr.exe 3788 bbbnhh.exe 3304 nnhbhb.exe 1036 vvvpj.exe 2916 xffxlxr.exe 3316 hhnhtt.exe 3900 5dvpj.exe 4388 1vddv.exe 4912 3rlxrlf.exe 1568 tbhbhh.exe 3476 nthhbn.exe 2788 5jjjd.exe 4976 lllxlfl.exe 208 5xxfrrf.exe 3792 tnhhbb.exe 3992 7jvjv.exe -
resource yara_rule behavioral2/memory/3576-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1888-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2148-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2148-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1244-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3312-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/696-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/440-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2920-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/352-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1536-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3316-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3792-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1328-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2176-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3880-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-709-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3576 wrote to memory of 1888 3576 cfbc83ffa9963558fde2b2469389fabdcd8d81398cf245f1006ba2e2077b003fN.exe 83 PID 3576 wrote to memory of 1888 3576 cfbc83ffa9963558fde2b2469389fabdcd8d81398cf245f1006ba2e2077b003fN.exe 83 PID 3576 wrote to memory of 1888 3576 cfbc83ffa9963558fde2b2469389fabdcd8d81398cf245f1006ba2e2077b003fN.exe 83 PID 1888 wrote to memory of 4640 1888 nbbtbb.exe 84 PID 1888 wrote to memory of 4640 1888 nbbtbb.exe 84 PID 1888 wrote to memory of 4640 1888 nbbtbb.exe 84 PID 4640 wrote to memory of 4496 4640 rrffxxr.exe 85 PID 4640 wrote to memory of 4496 4640 rrffxxr.exe 85 PID 4640 wrote to memory of 4496 4640 rrffxxr.exe 85 PID 4496 wrote to memory of 2148 4496 nbbbtt.exe 86 PID 4496 wrote to memory of 2148 4496 nbbbtt.exe 86 PID 4496 wrote to memory of 2148 4496 nbbbtt.exe 86 PID 2148 wrote to memory of 2308 2148 9nnbbb.exe 87 PID 2148 wrote to memory of 2308 2148 9nnbbb.exe 87 PID 2148 wrote to memory of 2308 2148 9nnbbb.exe 87 PID 2308 wrote to memory of 1724 2308 5dvpj.exe 88 PID 2308 wrote to memory of 1724 2308 5dvpj.exe 88 PID 2308 wrote to memory of 1724 2308 5dvpj.exe 88 PID 1724 wrote to memory of 64 1724 hbtntn.exe 89 PID 1724 wrote to memory of 64 1724 hbtntn.exe 89 PID 1724 wrote to memory of 64 1724 hbtntn.exe 89 PID 64 wrote to memory of 2264 64 dvvpj.exe 90 PID 64 wrote to memory of 2264 64 dvvpj.exe 90 PID 64 wrote to memory of 2264 64 dvvpj.exe 90 PID 2264 wrote to memory of 1244 2264 tttbtt.exe 91 PID 2264 wrote to memory of 1244 2264 tttbtt.exe 91 PID 2264 wrote to memory of 1244 2264 tttbtt.exe 91 PID 1244 wrote to memory of 4176 1244 xfxrllf.exe 92 PID 1244 wrote to memory of 4176 1244 xfxrllf.exe 92 PID 1244 wrote to memory of 4176 1244 xfxrllf.exe 92 PID 4176 wrote to memory of 1980 4176 xxrlfll.exe 93 PID 4176 wrote to memory of 1980 4176 xxrlfll.exe 93 PID 4176 wrote to memory of 1980 4176 xxrlfll.exe 93 PID 1980 wrote to memory of 3480 1980 9nnnhb.exe 94 PID 1980 wrote to memory of 3480 1980 9nnnhb.exe 94 PID 1980 wrote to memory of 3480 1980 9nnnhb.exe 94 PID 3480 wrote to memory of 2572 3480 lxxxrrr.exe 95 PID 3480 wrote to memory of 2572 3480 lxxxrrr.exe 95 PID 3480 wrote to memory of 2572 3480 lxxxrrr.exe 95 PID 2572 wrote to memory of 3312 2572 bbhhnn.exe 96 PID 2572 wrote to memory of 3312 2572 bbhhnn.exe 96 PID 2572 wrote to memory of 3312 2572 bbhhnn.exe 96 PID 3312 wrote to memory of 4184 3312 djjdv.exe 97 PID 3312 wrote to memory of 4184 3312 djjdv.exe 97 PID 3312 wrote to memory of 4184 3312 djjdv.exe 97 PID 4184 wrote to memory of 3152 4184 rflfxxr.exe 98 PID 4184 wrote to memory of 3152 4184 rflfxxr.exe 98 PID 4184 wrote to memory of 3152 4184 rflfxxr.exe 98 PID 3152 wrote to memory of 4424 3152 xxflrrl.exe 99 PID 3152 wrote to memory of 4424 3152 xxflrrl.exe 99 PID 3152 wrote to memory of 4424 3152 xxflrrl.exe 99 PID 4424 wrote to memory of 440 4424 jjppv.exe 100 PID 4424 wrote to memory of 440 4424 jjppv.exe 100 PID 4424 wrote to memory of 440 4424 jjppv.exe 100 PID 440 wrote to memory of 696 440 xrxffxx.exe 101 PID 440 wrote to memory of 696 440 xrxffxx.exe 101 PID 440 wrote to memory of 696 440 xrxffxx.exe 101 PID 696 wrote to memory of 2920 696 tbtnhh.exe 102 PID 696 wrote to memory of 2920 696 tbtnhh.exe 102 PID 696 wrote to memory of 2920 696 tbtnhh.exe 102 PID 2920 wrote to memory of 1104 2920 ddddv.exe 103 PID 2920 wrote to memory of 1104 2920 ddddv.exe 103 PID 2920 wrote to memory of 1104 2920 ddddv.exe 103 PID 1104 wrote to memory of 1544 1104 nhhtnn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfbc83ffa9963558fde2b2469389fabdcd8d81398cf245f1006ba2e2077b003fN.exe"C:\Users\Admin\AppData\Local\Temp\cfbc83ffa9963558fde2b2469389fabdcd8d81398cf245f1006ba2e2077b003fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\nbbtbb.exec:\nbbtbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\rrffxxr.exec:\rrffxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\nbbbtt.exec:\nbbbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\9nnbbb.exec:\9nnbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\5dvpj.exec:\5dvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\hbtntn.exec:\hbtntn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\dvvpj.exec:\dvvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\tttbtt.exec:\tttbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\xfxrllf.exec:\xfxrllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\xxrlfll.exec:\xxrlfll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\9nnnhb.exec:\9nnnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\bbhhnn.exec:\bbhhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\djjdv.exec:\djjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\rflfxxr.exec:\rflfxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\xxflrrl.exec:\xxflrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\jjppv.exec:\jjppv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\xrxffxx.exec:\xrxffxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\tbtnhh.exec:\tbtnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\ddddv.exec:\ddddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\nhhtnn.exec:\nhhtnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\vvpjd.exec:\vvpjd.exe23⤵
- Executes dropped EXE
PID:1544 -
\??\c:\7frllrl.exec:\7frllrl.exe24⤵
- Executes dropped EXE
PID:2480 -
\??\c:\7nnnhh.exec:\7nnnhh.exe25⤵
- Executes dropped EXE
PID:1804 -
\??\c:\xxxfxrr.exec:\xxxfxrr.exe26⤵
- Executes dropped EXE
PID:3724 -
\??\c:\pjpjd.exec:\pjpjd.exe27⤵
- Executes dropped EXE
PID:1480 -
\??\c:\1rlfllf.exec:\1rlfllf.exe28⤵
- Executes dropped EXE
PID:1808 -
\??\c:\bbbttn.exec:\bbbttn.exe29⤵
- Executes dropped EXE
PID:352 -
\??\c:\xfxffrl.exec:\xfxffrl.exe30⤵
- Executes dropped EXE
PID:2388 -
\??\c:\frxflxf.exec:\frxflxf.exe31⤵
- Executes dropped EXE
PID:3672 -
\??\c:\bthtbt.exec:\bthtbt.exe32⤵
- Executes dropped EXE
PID:868 -
\??\c:\jdvjj.exec:\jdvjj.exe33⤵
- Executes dropped EXE
PID:1876 -
\??\c:\xxxllff.exec:\xxxllff.exe34⤵
- Executes dropped EXE
PID:4688 -
\??\c:\vjdpd.exec:\vjdpd.exe35⤵
- Executes dropped EXE
PID:1676 -
\??\c:\9xfxllx.exec:\9xfxllx.exe36⤵
- Executes dropped EXE
PID:3248 -
\??\c:\btnbbt.exec:\btnbbt.exe37⤵
- Executes dropped EXE
PID:1052 -
\??\c:\jddvv.exec:\jddvv.exe38⤵
- Executes dropped EXE
PID:2824 -
\??\c:\5flxlfx.exec:\5flxlfx.exe39⤵
- Executes dropped EXE
PID:1780 -
\??\c:\btnbnh.exec:\btnbnh.exe40⤵
- Executes dropped EXE
PID:4156 -
\??\c:\tntnhb.exec:\tntnhb.exe41⤵
- Executes dropped EXE
PID:1040 -
\??\c:\pppdv.exec:\pppdv.exe42⤵
- Executes dropped EXE
PID:1404 -
\??\c:\xrlxlfr.exec:\xrlxlfr.exe43⤵
- Executes dropped EXE
PID:4536 -
\??\c:\tnnhbt.exec:\tnnhbt.exe44⤵
- Executes dropped EXE
PID:1824 -
\??\c:\djpjd.exec:\djpjd.exe45⤵
- Executes dropped EXE
PID:1536 -
\??\c:\fxlrfxl.exec:\fxlrfxl.exe46⤵
- Executes dropped EXE
PID:4768 -
\??\c:\nhbhnh.exec:\nhbhnh.exe47⤵
- Executes dropped EXE
PID:3700 -
\??\c:\htnnbb.exec:\htnnbb.exe48⤵
- Executes dropped EXE
PID:2576 -
\??\c:\9djdv.exec:\9djdv.exe49⤵
- Executes dropped EXE
PID:5056 -
\??\c:\rffxxxr.exec:\rffxxxr.exe50⤵
- Executes dropped EXE
PID:3208 -
\??\c:\bbbnhh.exec:\bbbnhh.exe51⤵
- Executes dropped EXE
PID:3788 -
\??\c:\nnhbhb.exec:\nnhbhb.exe52⤵
- Executes dropped EXE
PID:3304 -
\??\c:\vvvpj.exec:\vvvpj.exe53⤵
- Executes dropped EXE
PID:1036 -
\??\c:\xffxlxr.exec:\xffxlxr.exe54⤵
- Executes dropped EXE
PID:2916 -
\??\c:\hhnhtt.exec:\hhnhtt.exe55⤵
- Executes dropped EXE
PID:3316 -
\??\c:\5dvpj.exec:\5dvpj.exe56⤵
- Executes dropped EXE
PID:3900 -
\??\c:\1vddv.exec:\1vddv.exe57⤵
- Executes dropped EXE
PID:4388 -
\??\c:\3rlxrlf.exec:\3rlxrlf.exe58⤵
- Executes dropped EXE
PID:4912 -
\??\c:\tbhbhh.exec:\tbhbhh.exe59⤵
- Executes dropped EXE
PID:1568 -
\??\c:\nthhbn.exec:\nthhbn.exe60⤵
- Executes dropped EXE
PID:3476 -
\??\c:\5jjjd.exec:\5jjjd.exe61⤵
- Executes dropped EXE
PID:2788 -
\??\c:\lllxlfl.exec:\lllxlfl.exe62⤵
- Executes dropped EXE
PID:4976 -
\??\c:\5xxfrrf.exec:\5xxfrrf.exe63⤵
- Executes dropped EXE
PID:208 -
\??\c:\tnhhbb.exec:\tnhhbb.exe64⤵
- Executes dropped EXE
PID:3792 -
\??\c:\7jvjv.exec:\7jvjv.exe65⤵
- Executes dropped EXE
PID:3992 -
\??\c:\lffrlxr.exec:\lffrlxr.exe66⤵PID:5020
-
\??\c:\djppp.exec:\djppp.exe67⤵PID:1172
-
\??\c:\dvddv.exec:\dvddv.exe68⤵PID:440
-
\??\c:\lxxlxrl.exec:\lxxlxrl.exe69⤵PID:1120
-
\??\c:\5tnbtt.exec:\5tnbtt.exe70⤵PID:4076
-
\??\c:\vvppv.exec:\vvppv.exe71⤵PID:1328
-
\??\c:\rfrlfxf.exec:\rfrlfxf.exe72⤵PID:224
-
\??\c:\7nhtnt.exec:\7nhtnt.exe73⤵PID:4708
-
\??\c:\jdjdd.exec:\jdjdd.exe74⤵PID:3452
-
\??\c:\jpvvp.exec:\jpvvp.exe75⤵PID:1828
-
\??\c:\rxrlfff.exec:\rxrlfff.exe76⤵PID:680
-
\??\c:\hhbbtt.exec:\hhbbtt.exe77⤵PID:4188
-
\??\c:\jvdpj.exec:\jvdpj.exe78⤵PID:4408
-
\??\c:\xflxllr.exec:\xflxllr.exe79⤵PID:5116
-
\??\c:\bnthhb.exec:\bnthhb.exe80⤵PID:3636
-
\??\c:\ppjvj.exec:\ppjvj.exe81⤵PID:2316
-
\??\c:\vdpdj.exec:\vdpdj.exe82⤵PID:1800
-
\??\c:\flxxxxr.exec:\flxxxxr.exe83⤵PID:3288
-
\??\c:\nhbtnn.exec:\nhbtnn.exe84⤵PID:2796
-
\??\c:\9hhbbh.exec:\9hhbbh.exe85⤵PID:552
-
\??\c:\7lxrrxr.exec:\7lxrrxr.exe86⤵PID:3572
-
\??\c:\nhhbbb.exec:\nhhbbb.exe87⤵
- System Location Discovery: System Language Discovery
PID:2176 -
\??\c:\htbttn.exec:\htbttn.exe88⤵PID:4212
-
\??\c:\vvddv.exec:\vvddv.exe89⤵PID:3672
-
\??\c:\vdpjd.exec:\vdpjd.exe90⤵PID:3232
-
\??\c:\9rrllrr.exec:\9rrllrr.exe91⤵PID:376
-
\??\c:\9thbtb.exec:\9thbtb.exe92⤵PID:1876
-
\??\c:\9vdvv.exec:\9vdvv.exe93⤵PID:2004
-
\??\c:\ppddv.exec:\ppddv.exe94⤵PID:3284
-
\??\c:\rfxxrll.exec:\rfxxrll.exe95⤵PID:540
-
\??\c:\5bttnn.exec:\5bttnn.exe96⤵PID:3504
-
\??\c:\pvvvp.exec:\pvvvp.exe97⤵PID:2044
-
\??\c:\jjdpj.exec:\jjdpj.exe98⤵PID:4344
-
\??\c:\frfxxxx.exec:\frfxxxx.exe99⤵PID:4360
-
\??\c:\5nnhbb.exec:\5nnhbb.exe100⤵PID:4428
-
\??\c:\dvdvv.exec:\dvdvv.exe101⤵PID:4928
-
\??\c:\5rrlfll.exec:\5rrlfll.exe102⤵PID:1712
-
\??\c:\llrrlrl.exec:\llrrlrl.exe103⤵PID:2444
-
\??\c:\hbbttt.exec:\hbbttt.exe104⤵PID:4640
-
\??\c:\dvdpv.exec:\dvdpv.exe105⤵PID:2416
-
\??\c:\llflfff.exec:\llflfff.exe106⤵PID:3060
-
\??\c:\hhnhtn.exec:\hhnhtn.exe107⤵PID:4844
-
\??\c:\9pddj.exec:\9pddj.exe108⤵PID:3660
-
\??\c:\vvvjd.exec:\vvvjd.exe109⤵PID:2308
-
\??\c:\xfffrrx.exec:\xfffrrx.exe110⤵PID:996
-
\??\c:\nthnth.exec:\nthnth.exe111⤵PID:3240
-
\??\c:\vvddv.exec:\vvddv.exe112⤵PID:4484
-
\??\c:\lxrfxxl.exec:\lxrfxxl.exe113⤵PID:4460
-
\??\c:\htttnn.exec:\htttnn.exe114⤵PID:1036
-
\??\c:\hnhbtt.exec:\hnhbtt.exe115⤵PID:2916
-
\??\c:\ppjdd.exec:\ppjdd.exe116⤵PID:1436
-
\??\c:\rffxllf.exec:\rffxllf.exe117⤵PID:1168
-
\??\c:\9nthbb.exec:\9nthbb.exe118⤵PID:1444
-
\??\c:\dddpp.exec:\dddpp.exe119⤵PID:3276
-
\??\c:\5jdvj.exec:\5jdvj.exe120⤵PID:2680
-
\??\c:\rfxlfrf.exec:\rfxlfrf.exe121⤵PID:4596
-
\??\c:\7tnhbb.exec:\7tnhbb.exe122⤵PID:2844
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-