Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 08:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bead6586be3766e954768b2351cc9fd72a58b7695ea64028b84ebe4e720d0daf.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
bead6586be3766e954768b2351cc9fd72a58b7695ea64028b84ebe4e720d0daf.exe
-
Size
454KB
-
MD5
447825776fd9a59b8af261b95d15cb99
-
SHA1
c9ddbfee7d8df52f5e44021ffe1f0191d1182eca
-
SHA256
bead6586be3766e954768b2351cc9fd72a58b7695ea64028b84ebe4e720d0daf
-
SHA512
611621a4cc9572edf97d707992b75db77a09203f34cd50528a6f8aec1abfe71f705daec2b24958f2973924e99a464d722e73197ae4440ceaa880d34405e2f619
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1m:q7Tc2NYHUrAwfMp3CD1m
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/5116-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1776-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2124-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2556-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1444-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4164-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3544-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2636-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2564-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4040-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2836-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3364-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3800-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1728-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-774-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-823-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-857-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-888-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1728-958-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-1184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-1287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-1345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5116 5rlfffx.exe 1068 9btnhh.exe 2556 tbhhtb.exe 1776 jjjdj.exe 2124 ffrllfx.exe 4004 thbthh.exe 4052 tbnnbb.exe 4352 btnhbt.exe 3968 dvjdd.exe 4864 llxxllx.exe 920 7hthbb.exe 2352 bttthh.exe 1212 rxxxlll.exe 4132 ttbthh.exe 4820 ddvpv.exe 1364 rrxrxrx.exe 2368 jppjv.exe 4944 bhtbnh.exe 1444 vdvvp.exe 4836 fxlfxrl.exe 3760 7bbbhn.exe 2888 vdpjv.exe 2836 5xxrllf.exe 372 ddddj.exe 1540 9rxlllx.exe 4432 rrlfxrr.exe 1812 lxrlffr.exe 3684 jjjjv.exe 4456 7tnhhn.exe 4164 rlffrrf.exe 2456 hhnhnn.exe 232 vpvjv.exe 2444 lrfllfl.exe 4000 1tthbt.exe 1664 7dppj.exe 1536 xxxrllf.exe 1520 tnhbtt.exe 4128 3dvdj.exe 1788 flfrllf.exe 1860 rffrffr.exe 3532 hnnnnt.exe 2880 dddpd.exe 5088 hhbthh.exe 4688 htbhhb.exe 1980 1lrlflf.exe 3280 btttnh.exe 1196 vdvpd.exe 1416 xxlxlrl.exe 2412 lfrlfxf.exe 1792 tntbnh.exe 640 1jpjv.exe 2464 llxlllx.exe 2440 hhbtnh.exe 4816 thnhbt.exe 3300 9djdv.exe 5004 ffxfrll.exe 2912 rxxlxrf.exe 5024 bthbtn.exe 4368 7vdpd.exe 3544 xxlxlfr.exe 4004 lrlfxrx.exe 3796 tbtnht.exe 4144 pppdv.exe 2056 xrrfxrl.exe -
resource yara_rule behavioral2/memory/5116-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1444-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1812-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3544-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2636-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2564-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4040-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2836-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3800-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1728-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-823-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-857-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-888-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1728-958-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5btnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fflffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1312 wrote to memory of 5116 1312 bead6586be3766e954768b2351cc9fd72a58b7695ea64028b84ebe4e720d0daf.exe 83 PID 1312 wrote to memory of 5116 1312 bead6586be3766e954768b2351cc9fd72a58b7695ea64028b84ebe4e720d0daf.exe 83 PID 1312 wrote to memory of 5116 1312 bead6586be3766e954768b2351cc9fd72a58b7695ea64028b84ebe4e720d0daf.exe 83 PID 5116 wrote to memory of 1068 5116 5rlfffx.exe 84 PID 5116 wrote to memory of 1068 5116 5rlfffx.exe 84 PID 5116 wrote to memory of 1068 5116 5rlfffx.exe 84 PID 1068 wrote to memory of 2556 1068 9btnhh.exe 85 PID 1068 wrote to memory of 2556 1068 9btnhh.exe 85 PID 1068 wrote to memory of 2556 1068 9btnhh.exe 85 PID 2556 wrote to memory of 1776 2556 tbhhtb.exe 86 PID 2556 wrote to memory of 1776 2556 tbhhtb.exe 86 PID 2556 wrote to memory of 1776 2556 tbhhtb.exe 86 PID 1776 wrote to memory of 2124 1776 jjjdj.exe 87 PID 1776 wrote to memory of 2124 1776 jjjdj.exe 87 PID 1776 wrote to memory of 2124 1776 jjjdj.exe 87 PID 2124 wrote to memory of 4004 2124 ffrllfx.exe 88 PID 2124 wrote to memory of 4004 2124 ffrllfx.exe 88 PID 2124 wrote to memory of 4004 2124 ffrllfx.exe 88 PID 4004 wrote to memory of 4052 4004 thbthh.exe 89 PID 4004 wrote to memory of 4052 4004 thbthh.exe 89 PID 4004 wrote to memory of 4052 4004 thbthh.exe 89 PID 4052 wrote to memory of 4352 4052 tbnnbb.exe 90 PID 4052 wrote to memory of 4352 4052 tbnnbb.exe 90 PID 4052 wrote to memory of 4352 4052 tbnnbb.exe 90 PID 4352 wrote to memory of 3968 4352 btnhbt.exe 91 PID 4352 wrote to memory of 3968 4352 btnhbt.exe 91 PID 4352 wrote to memory of 3968 4352 btnhbt.exe 91 PID 3968 wrote to memory of 4864 3968 dvjdd.exe 92 PID 3968 wrote to memory of 4864 3968 dvjdd.exe 92 PID 3968 wrote to memory of 4864 3968 dvjdd.exe 92 PID 4864 wrote to memory of 920 4864 llxxllx.exe 93 PID 4864 wrote to memory of 920 4864 llxxllx.exe 93 PID 4864 wrote to memory of 920 4864 llxxllx.exe 93 PID 920 wrote to memory of 2352 920 7hthbb.exe 94 PID 920 wrote to memory of 2352 920 7hthbb.exe 94 PID 920 wrote to memory of 2352 920 7hthbb.exe 94 PID 2352 wrote to memory of 1212 2352 bttthh.exe 95 PID 2352 wrote to memory of 1212 2352 bttthh.exe 95 PID 2352 wrote to memory of 1212 2352 bttthh.exe 95 PID 1212 wrote to memory of 4132 1212 rxxxlll.exe 96 PID 1212 wrote to memory of 4132 1212 rxxxlll.exe 96 PID 1212 wrote to memory of 4132 1212 rxxxlll.exe 96 PID 4132 wrote to memory of 4820 4132 ttbthh.exe 97 PID 4132 wrote to memory of 4820 4132 ttbthh.exe 97 PID 4132 wrote to memory of 4820 4132 ttbthh.exe 97 PID 4820 wrote to memory of 1364 4820 ddvpv.exe 98 PID 4820 wrote to memory of 1364 4820 ddvpv.exe 98 PID 4820 wrote to memory of 1364 4820 ddvpv.exe 98 PID 1364 wrote to memory of 2368 1364 rrxrxrx.exe 99 PID 1364 wrote to memory of 2368 1364 rrxrxrx.exe 99 PID 1364 wrote to memory of 2368 1364 rrxrxrx.exe 99 PID 2368 wrote to memory of 4944 2368 jppjv.exe 100 PID 2368 wrote to memory of 4944 2368 jppjv.exe 100 PID 2368 wrote to memory of 4944 2368 jppjv.exe 100 PID 4944 wrote to memory of 1444 4944 bhtbnh.exe 101 PID 4944 wrote to memory of 1444 4944 bhtbnh.exe 101 PID 4944 wrote to memory of 1444 4944 bhtbnh.exe 101 PID 1444 wrote to memory of 4836 1444 vdvvp.exe 102 PID 1444 wrote to memory of 4836 1444 vdvvp.exe 102 PID 1444 wrote to memory of 4836 1444 vdvvp.exe 102 PID 4836 wrote to memory of 3760 4836 fxlfxrl.exe 103 PID 4836 wrote to memory of 3760 4836 fxlfxrl.exe 103 PID 4836 wrote to memory of 3760 4836 fxlfxrl.exe 103 PID 3760 wrote to memory of 2888 3760 7bbbhn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\bead6586be3766e954768b2351cc9fd72a58b7695ea64028b84ebe4e720d0daf.exe"C:\Users\Admin\AppData\Local\Temp\bead6586be3766e954768b2351cc9fd72a58b7695ea64028b84ebe4e720d0daf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\5rlfffx.exec:\5rlfffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\9btnhh.exec:\9btnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\tbhhtb.exec:\tbhhtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\jjjdj.exec:\jjjdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\ffrllfx.exec:\ffrllfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\thbthh.exec:\thbthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\tbnnbb.exec:\tbnnbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\btnhbt.exec:\btnhbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\dvjdd.exec:\dvjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\llxxllx.exec:\llxxllx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\7hthbb.exec:\7hthbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\bttthh.exec:\bttthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\rxxxlll.exec:\rxxxlll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\ttbthh.exec:\ttbthh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\ddvpv.exec:\ddvpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\rrxrxrx.exec:\rrxrxrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\jppjv.exec:\jppjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\bhtbnh.exec:\bhtbnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\vdvvp.exec:\vdvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\fxlfxrl.exec:\fxlfxrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\7bbbhn.exec:\7bbbhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\vdpjv.exec:\vdpjv.exe23⤵
- Executes dropped EXE
PID:2888 -
\??\c:\5xxrllf.exec:\5xxrllf.exe24⤵
- Executes dropped EXE
PID:2836 -
\??\c:\ddddj.exec:\ddddj.exe25⤵
- Executes dropped EXE
PID:372 -
\??\c:\9rxlllx.exec:\9rxlllx.exe26⤵
- Executes dropped EXE
PID:1540 -
\??\c:\rrlfxrr.exec:\rrlfxrr.exe27⤵
- Executes dropped EXE
PID:4432 -
\??\c:\lxrlffr.exec:\lxrlffr.exe28⤵
- Executes dropped EXE
PID:1812 -
\??\c:\jjjjv.exec:\jjjjv.exe29⤵
- Executes dropped EXE
PID:3684 -
\??\c:\7tnhhn.exec:\7tnhhn.exe30⤵
- Executes dropped EXE
PID:4456 -
\??\c:\rlffrrf.exec:\rlffrrf.exe31⤵
- Executes dropped EXE
PID:4164 -
\??\c:\hhnhnn.exec:\hhnhnn.exe32⤵
- Executes dropped EXE
PID:2456 -
\??\c:\vpvjv.exec:\vpvjv.exe33⤵
- Executes dropped EXE
PID:232 -
\??\c:\lrfllfl.exec:\lrfllfl.exe34⤵
- Executes dropped EXE
PID:2444 -
\??\c:\1tthbt.exec:\1tthbt.exe35⤵
- Executes dropped EXE
PID:4000 -
\??\c:\7dppj.exec:\7dppj.exe36⤵
- Executes dropped EXE
PID:1664 -
\??\c:\xxxrllf.exec:\xxxrllf.exe37⤵
- Executes dropped EXE
PID:1536 -
\??\c:\tnhbtt.exec:\tnhbtt.exe38⤵
- Executes dropped EXE
PID:1520 -
\??\c:\3dvdj.exec:\3dvdj.exe39⤵
- Executes dropped EXE
PID:4128 -
\??\c:\flfrllf.exec:\flfrllf.exe40⤵
- Executes dropped EXE
PID:1788 -
\??\c:\rffrffr.exec:\rffrffr.exe41⤵
- Executes dropped EXE
PID:1860 -
\??\c:\hnnnnt.exec:\hnnnnt.exe42⤵
- Executes dropped EXE
PID:3532 -
\??\c:\dddpd.exec:\dddpd.exe43⤵
- Executes dropped EXE
PID:2880 -
\??\c:\hhbthh.exec:\hhbthh.exe44⤵
- Executes dropped EXE
PID:5088 -
\??\c:\htbhhb.exec:\htbhhb.exe45⤵
- Executes dropped EXE
PID:4688 -
\??\c:\1lrlflf.exec:\1lrlflf.exe46⤵
- Executes dropped EXE
PID:1980 -
\??\c:\btttnh.exec:\btttnh.exe47⤵
- Executes dropped EXE
PID:3280 -
\??\c:\vdvpd.exec:\vdvpd.exe48⤵
- Executes dropped EXE
PID:1196 -
\??\c:\xxlxlrl.exec:\xxlxlrl.exe49⤵
- Executes dropped EXE
PID:1416 -
\??\c:\lfrlfxf.exec:\lfrlfxf.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2412 -
\??\c:\tntbnh.exec:\tntbnh.exe51⤵
- Executes dropped EXE
PID:1792 -
\??\c:\1jpjv.exec:\1jpjv.exe52⤵
- Executes dropped EXE
PID:640 -
\??\c:\llxlllx.exec:\llxlllx.exe53⤵
- Executes dropped EXE
PID:2464 -
\??\c:\hhbtnh.exec:\hhbtnh.exe54⤵
- Executes dropped EXE
PID:2440 -
\??\c:\thnhbt.exec:\thnhbt.exe55⤵
- Executes dropped EXE
PID:4816 -
\??\c:\9djdv.exec:\9djdv.exe56⤵
- Executes dropped EXE
PID:3300 -
\??\c:\ffxfrll.exec:\ffxfrll.exe57⤵
- Executes dropped EXE
PID:5004 -
\??\c:\rxxlxrf.exec:\rxxlxrf.exe58⤵
- Executes dropped EXE
PID:2912 -
\??\c:\bthbtn.exec:\bthbtn.exe59⤵
- Executes dropped EXE
PID:5024 -
\??\c:\7vdpd.exec:\7vdpd.exe60⤵
- Executes dropped EXE
PID:4368 -
\??\c:\xxlxlfr.exec:\xxlxlfr.exe61⤵
- Executes dropped EXE
PID:3544 -
\??\c:\lrlfxrx.exec:\lrlfxrx.exe62⤵
- Executes dropped EXE
PID:4004 -
\??\c:\tbtnht.exec:\tbtnht.exe63⤵
- Executes dropped EXE
PID:3796 -
\??\c:\pppdv.exec:\pppdv.exe64⤵
- Executes dropped EXE
PID:4144 -
\??\c:\xrrfxrl.exec:\xrrfxrl.exe65⤵
- Executes dropped EXE
PID:2056 -
\??\c:\1rxrlfr.exec:\1rxrlfr.exe66⤵PID:1960
-
\??\c:\tnbtnt.exec:\tnbtnt.exe67⤵PID:2636
-
\??\c:\ppjdv.exec:\ppjdv.exe68⤵PID:3032
-
\??\c:\pddpj.exec:\pddpj.exe69⤵PID:3284
-
\??\c:\xrfxrrf.exec:\xrfxrrf.exe70⤵PID:1104
-
\??\c:\1bbthh.exec:\1bbthh.exe71⤵PID:2564
-
\??\c:\tbtnhb.exec:\tbtnhb.exe72⤵PID:1896
-
\??\c:\1xxfrrr.exec:\1xxfrrr.exe73⤵PID:3224
-
\??\c:\flflxfx.exec:\flflxfx.exe74⤵PID:404
-
\??\c:\nbnhbt.exec:\nbnhbt.exe75⤵PID:2216
-
\??\c:\vjdpd.exec:\vjdpd.exe76⤵
- System Location Discovery: System Language Discovery
PID:3952 -
\??\c:\xflfllr.exec:\xflfllr.exe77⤵PID:4040
-
\??\c:\7xrrllf.exec:\7xrrllf.exe78⤵PID:2368
-
\??\c:\9bntht.exec:\9bntht.exe79⤵PID:388
-
\??\c:\vppjd.exec:\vppjd.exe80⤵PID:3332
-
\??\c:\rfxrllf.exec:\rfxrllf.exe81⤵PID:1372
-
\??\c:\9htnbt.exec:\9htnbt.exe82⤵PID:2940
-
\??\c:\1pppj.exec:\1pppj.exe83⤵PID:636
-
\??\c:\jpvdv.exec:\jpvdv.exe84⤵PID:2008
-
\??\c:\flfxrlf.exec:\flfxrlf.exe85⤵PID:2836
-
\??\c:\9bbtnn.exec:\9bbtnn.exe86⤵PID:376
-
\??\c:\1nttnt.exec:\1nttnt.exe87⤵PID:4568
-
\??\c:\jpvjv.exec:\jpvjv.exe88⤵PID:1300
-
\??\c:\xfffxff.exec:\xfffxff.exe89⤵PID:2580
-
\??\c:\nbhhhn.exec:\nbhhhn.exe90⤵PID:4772
-
\??\c:\tbhhhb.exec:\tbhhhb.exe91⤵PID:1696
-
\??\c:\jdjjd.exec:\jdjjd.exe92⤵PID:2948
-
\??\c:\3fxxxxr.exec:\3fxxxxr.exe93⤵PID:4696
-
\??\c:\tbnnht.exec:\tbnnht.exe94⤵PID:3708
-
\??\c:\djjpj.exec:\djjpj.exe95⤵PID:1388
-
\??\c:\ffffxrr.exec:\ffffxrr.exe96⤵PID:2676
-
\??\c:\rlllfff.exec:\rlllfff.exe97⤵PID:1684
-
\??\c:\7bthnt.exec:\7bthnt.exe98⤵PID:1884
-
\??\c:\jvvvv.exec:\jvvvv.exe99⤵PID:2184
-
\??\c:\djpjj.exec:\djpjj.exe100⤵PID:3364
-
\??\c:\lrffllr.exec:\lrffllr.exe101⤵PID:4908
-
\??\c:\5bhbbb.exec:\5bhbbb.exe102⤵PID:1620
-
\??\c:\vddjj.exec:\vddjj.exe103⤵PID:2760
-
\??\c:\rfxrllf.exec:\rfxrllf.exe104⤵PID:1860
-
\??\c:\xlxrrrl.exec:\xlxrrrl.exe105⤵PID:2472
-
\??\c:\hnttnn.exec:\hnttnn.exe106⤵PID:4280
-
\??\c:\vjjjv.exec:\vjjjv.exe107⤵PID:2560
-
\??\c:\lfffxxr.exec:\lfffxxr.exe108⤵PID:1632
-
\??\c:\lrrrlrl.exec:\lrrrlrl.exe109⤵PID:2308
-
\??\c:\ttbbbb.exec:\ttbbbb.exe110⤵PID:3076
-
\??\c:\nhhhbb.exec:\nhhhbb.exe111⤵PID:3156
-
\??\c:\5pjjd.exec:\5pjjd.exe112⤵PID:2092
-
\??\c:\rrrffxr.exec:\rrrffxr.exe113⤵PID:2548
-
\??\c:\fxrfxxl.exec:\fxrfxxl.exe114⤵PID:4356
-
\??\c:\hhbbnn.exec:\hhbbnn.exe115⤵
- System Location Discovery: System Language Discovery
PID:4344 -
\??\c:\5ddvp.exec:\5ddvp.exe116⤵PID:640
-
\??\c:\pppjd.exec:\pppjd.exe117⤵PID:2464
-
\??\c:\xfrrlxx.exec:\xfrrlxx.exe118⤵PID:2440
-
\??\c:\tnhbhh.exec:\tnhbhh.exe119⤵PID:516
-
\??\c:\djppp.exec:\djppp.exe120⤵PID:4564
-
\??\c:\ddddd.exec:\ddddd.exe121⤵PID:2124
-
\??\c:\xxrrllf.exec:\xxrrllf.exe122⤵PID:4600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-