Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 09:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0d50acbddc42d580627e1b4c729aca2962d9d0c0420318ec6def7bb86b94d94d.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
0d50acbddc42d580627e1b4c729aca2962d9d0c0420318ec6def7bb86b94d94d.exe
-
Size
454KB
-
MD5
0bf470511ee819a2d316fc1b282dac47
-
SHA1
360f77e95e0ee38dab350a0244c10c8902b70297
-
SHA256
0d50acbddc42d580627e1b4c729aca2962d9d0c0420318ec6def7bb86b94d94d
-
SHA512
744ad2a8538d42a6c359a2afe0be7613686d18ba1ffaa468d706b24a8b61a07677e0db5f465b24e3f57043192f671f174f2f9e204469f9fdbf5504fcaf278d2f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeTe:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/1888-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4180-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1248-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3460-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1588-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/516-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3868-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1852-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/712-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4668-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/832-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-637-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1128-639-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-669-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-685-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-887-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/896-927-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4180 hthnnt.exe 3612 bbnnhh.exe 4480 jpjpp.exe 1188 lfxfxxl.exe 4908 djddd.exe 4352 vjppp.exe 3920 3flflxx.exe 2628 ttbbbb.exe 4124 nhhbbh.exe 1248 tntttt.exe 2868 frllllr.exe 4176 ttbnnh.exe 1076 pdjdv.exe 3460 pdjdj.exe 4792 lflrrxf.exe 3436 hbnntb.exe 2448 xrlrlll.exe 5052 jjvpp.exe 5104 fxlrlrl.exe 1588 hnhttn.exe 1948 nthhth.exe 3476 hntbbn.exe 3496 jddvj.exe 2788 htnhhh.exe 3020 fxxxffx.exe 4448 hnttbn.exe 516 bbbhbh.exe 4348 thbttb.exe 1808 rrrrllf.exe 1584 thbhhn.exe 4004 fxxrrrr.exe 3868 tttthn.exe 1400 vjddd.exe 4464 xllfffr.exe 2620 jjppd.exe 3632 fxrxxlr.exe 1852 hbbbbt.exe 3504 pddpj.exe 4516 xflrrxx.exe 712 bbtbhn.exe 3684 jpdvp.exe 1920 rxxfrff.exe 4868 bbbnnt.exe 2456 fxxrlxl.exe 5000 hhhhnn.exe 1864 dddvv.exe 5112 hthttt.exe 4952 pvvpj.exe 4752 lffxlfx.exe 4320 pdjdd.exe 4204 lxxrlxf.exe 5092 tnbhtn.exe 4880 jppdd.exe 448 lxfxfff.exe 1712 dddvv.exe 4668 vdjjp.exe 2408 hhttnb.exe 1928 pjjdd.exe 1404 pvpjj.exe 3548 flrrllx.exe 3680 bthbth.exe 2328 lrfffll.exe 2628 tbthnn.exe 4052 pdjjj.exe -
resource yara_rule behavioral2/memory/1888-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1248-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3460-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/516-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1808-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1852-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/712-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4668-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2328-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/832-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3040-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1128-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-887-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ffffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1888 wrote to memory of 4180 1888 0d50acbddc42d580627e1b4c729aca2962d9d0c0420318ec6def7bb86b94d94d.exe 82 PID 1888 wrote to memory of 4180 1888 0d50acbddc42d580627e1b4c729aca2962d9d0c0420318ec6def7bb86b94d94d.exe 82 PID 1888 wrote to memory of 4180 1888 0d50acbddc42d580627e1b4c729aca2962d9d0c0420318ec6def7bb86b94d94d.exe 82 PID 4180 wrote to memory of 3612 4180 hthnnt.exe 83 PID 4180 wrote to memory of 3612 4180 hthnnt.exe 83 PID 4180 wrote to memory of 3612 4180 hthnnt.exe 83 PID 3612 wrote to memory of 4480 3612 bbnnhh.exe 84 PID 3612 wrote to memory of 4480 3612 bbnnhh.exe 84 PID 3612 wrote to memory of 4480 3612 bbnnhh.exe 84 PID 4480 wrote to memory of 1188 4480 jpjpp.exe 85 PID 4480 wrote to memory of 1188 4480 jpjpp.exe 85 PID 4480 wrote to memory of 1188 4480 jpjpp.exe 85 PID 1188 wrote to memory of 4908 1188 lfxfxxl.exe 86 PID 1188 wrote to memory of 4908 1188 lfxfxxl.exe 86 PID 1188 wrote to memory of 4908 1188 lfxfxxl.exe 86 PID 4908 wrote to memory of 4352 4908 djddd.exe 87 PID 4908 wrote to memory of 4352 4908 djddd.exe 87 PID 4908 wrote to memory of 4352 4908 djddd.exe 87 PID 4352 wrote to memory of 3920 4352 vjppp.exe 88 PID 4352 wrote to memory of 3920 4352 vjppp.exe 88 PID 4352 wrote to memory of 3920 4352 vjppp.exe 88 PID 3920 wrote to memory of 2628 3920 3flflxx.exe 89 PID 3920 wrote to memory of 2628 3920 3flflxx.exe 89 PID 3920 wrote to memory of 2628 3920 3flflxx.exe 89 PID 2628 wrote to memory of 4124 2628 ttbbbb.exe 90 PID 2628 wrote to memory of 4124 2628 ttbbbb.exe 90 PID 2628 wrote to memory of 4124 2628 ttbbbb.exe 90 PID 4124 wrote to memory of 1248 4124 nhhbbh.exe 91 PID 4124 wrote to memory of 1248 4124 nhhbbh.exe 91 PID 4124 wrote to memory of 1248 4124 nhhbbh.exe 91 PID 1248 wrote to memory of 2868 1248 tntttt.exe 92 PID 1248 wrote to memory of 2868 1248 tntttt.exe 92 PID 1248 wrote to memory of 2868 1248 tntttt.exe 92 PID 2868 wrote to memory of 4176 2868 frllllr.exe 93 PID 2868 wrote to memory of 4176 2868 frllllr.exe 93 PID 2868 wrote to memory of 4176 2868 frllllr.exe 93 PID 4176 wrote to memory of 1076 4176 ttbnnh.exe 94 PID 4176 wrote to memory of 1076 4176 ttbnnh.exe 94 PID 4176 wrote to memory of 1076 4176 ttbnnh.exe 94 PID 1076 wrote to memory of 3460 1076 pdjdv.exe 95 PID 1076 wrote to memory of 3460 1076 pdjdv.exe 95 PID 1076 wrote to memory of 3460 1076 pdjdv.exe 95 PID 3460 wrote to memory of 4792 3460 pdjdj.exe 96 PID 3460 wrote to memory of 4792 3460 pdjdj.exe 96 PID 3460 wrote to memory of 4792 3460 pdjdj.exe 96 PID 4792 wrote to memory of 3436 4792 lflrrxf.exe 97 PID 4792 wrote to memory of 3436 4792 lflrrxf.exe 97 PID 4792 wrote to memory of 3436 4792 lflrrxf.exe 97 PID 3436 wrote to memory of 2448 3436 hbnntb.exe 98 PID 3436 wrote to memory of 2448 3436 hbnntb.exe 98 PID 3436 wrote to memory of 2448 3436 hbnntb.exe 98 PID 2448 wrote to memory of 5052 2448 xrlrlll.exe 99 PID 2448 wrote to memory of 5052 2448 xrlrlll.exe 99 PID 2448 wrote to memory of 5052 2448 xrlrlll.exe 99 PID 5052 wrote to memory of 5104 5052 jjvpp.exe 100 PID 5052 wrote to memory of 5104 5052 jjvpp.exe 100 PID 5052 wrote to memory of 5104 5052 jjvpp.exe 100 PID 5104 wrote to memory of 1588 5104 fxlrlrl.exe 101 PID 5104 wrote to memory of 1588 5104 fxlrlrl.exe 101 PID 5104 wrote to memory of 1588 5104 fxlrlrl.exe 101 PID 1588 wrote to memory of 1948 1588 hnhttn.exe 102 PID 1588 wrote to memory of 1948 1588 hnhttn.exe 102 PID 1588 wrote to memory of 1948 1588 hnhttn.exe 102 PID 1948 wrote to memory of 3476 1948 nthhth.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d50acbddc42d580627e1b4c729aca2962d9d0c0420318ec6def7bb86b94d94d.exe"C:\Users\Admin\AppData\Local\Temp\0d50acbddc42d580627e1b4c729aca2962d9d0c0420318ec6def7bb86b94d94d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\hthnnt.exec:\hthnnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\bbnnhh.exec:\bbnnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\jpjpp.exec:\jpjpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\lfxfxxl.exec:\lfxfxxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\djddd.exec:\djddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\vjppp.exec:\vjppp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\3flflxx.exec:\3flflxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\ttbbbb.exec:\ttbbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\nhhbbh.exec:\nhhbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\tntttt.exec:\tntttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\frllllr.exec:\frllllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\ttbnnh.exec:\ttbnnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\pdjdv.exec:\pdjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\pdjdj.exec:\pdjdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\lflrrxf.exec:\lflrrxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\hbnntb.exec:\hbnntb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\xrlrlll.exec:\xrlrlll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\jjvpp.exec:\jjvpp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\fxlrlrl.exec:\fxlrlrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\hnhttn.exec:\hnhttn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\nthhth.exec:\nthhth.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\hntbbn.exec:\hntbbn.exe23⤵
- Executes dropped EXE
PID:3476 -
\??\c:\jddvj.exec:\jddvj.exe24⤵
- Executes dropped EXE
PID:3496 -
\??\c:\htnhhh.exec:\htnhhh.exe25⤵
- Executes dropped EXE
PID:2788 -
\??\c:\fxxxffx.exec:\fxxxffx.exe26⤵
- Executes dropped EXE
PID:3020 -
\??\c:\hnttbn.exec:\hnttbn.exe27⤵
- Executes dropped EXE
PID:4448 -
\??\c:\bbbhbh.exec:\bbbhbh.exe28⤵
- Executes dropped EXE
PID:516 -
\??\c:\thbttb.exec:\thbttb.exe29⤵
- Executes dropped EXE
PID:4348 -
\??\c:\rrrrllf.exec:\rrrrllf.exe30⤵
- Executes dropped EXE
PID:1808 -
\??\c:\thbhhn.exec:\thbhhn.exe31⤵
- Executes dropped EXE
PID:1584 -
\??\c:\fxxrrrr.exec:\fxxrrrr.exe32⤵
- Executes dropped EXE
PID:4004 -
\??\c:\tttthn.exec:\tttthn.exe33⤵
- Executes dropped EXE
PID:3868 -
\??\c:\vjddd.exec:\vjddd.exe34⤵
- Executes dropped EXE
PID:1400 -
\??\c:\xllfffr.exec:\xllfffr.exe35⤵
- Executes dropped EXE
PID:4464 -
\??\c:\jjppd.exec:\jjppd.exe36⤵
- Executes dropped EXE
PID:2620 -
\??\c:\fxrxxlr.exec:\fxrxxlr.exe37⤵
- Executes dropped EXE
PID:3632 -
\??\c:\hbbbbt.exec:\hbbbbt.exe38⤵
- Executes dropped EXE
PID:1852 -
\??\c:\pddpj.exec:\pddpj.exe39⤵
- Executes dropped EXE
PID:3504 -
\??\c:\xflrrxx.exec:\xflrrxx.exe40⤵
- Executes dropped EXE
PID:4516 -
\??\c:\bbtbhn.exec:\bbtbhn.exe41⤵
- Executes dropped EXE
PID:712 -
\??\c:\jpdvp.exec:\jpdvp.exe42⤵
- Executes dropped EXE
PID:3684 -
\??\c:\rxxfrff.exec:\rxxfrff.exe43⤵
- Executes dropped EXE
PID:1920 -
\??\c:\bbbnnt.exec:\bbbnnt.exe44⤵
- Executes dropped EXE
PID:4868 -
\??\c:\fxxrlxl.exec:\fxxrlxl.exe45⤵
- Executes dropped EXE
PID:2456 -
\??\c:\hhhhnn.exec:\hhhhnn.exe46⤵
- Executes dropped EXE
PID:5000 -
\??\c:\dddvv.exec:\dddvv.exe47⤵
- Executes dropped EXE
PID:1864 -
\??\c:\hthttt.exec:\hthttt.exe48⤵
- Executes dropped EXE
PID:5112 -
\??\c:\pvvpj.exec:\pvvpj.exe49⤵
- Executes dropped EXE
PID:4952 -
\??\c:\lffxlfx.exec:\lffxlfx.exe50⤵
- Executes dropped EXE
PID:4752 -
\??\c:\pdjdd.exec:\pdjdd.exe51⤵
- Executes dropped EXE
PID:4320 -
\??\c:\lxxrlxf.exec:\lxxrlxf.exe52⤵
- Executes dropped EXE
PID:4204 -
\??\c:\tnbhtn.exec:\tnbhtn.exe53⤵
- Executes dropped EXE
PID:5092 -
\??\c:\jppdd.exec:\jppdd.exe54⤵
- Executes dropped EXE
PID:4880 -
\??\c:\lxfxfff.exec:\lxfxfff.exe55⤵
- Executes dropped EXE
PID:448 -
\??\c:\dddvv.exec:\dddvv.exe56⤵
- Executes dropped EXE
PID:1712 -
\??\c:\vdjjp.exec:\vdjjp.exe57⤵
- Executes dropped EXE
PID:4668 -
\??\c:\hhttnb.exec:\hhttnb.exe58⤵
- Executes dropped EXE
PID:2408 -
\??\c:\pjjdd.exec:\pjjdd.exe59⤵
- Executes dropped EXE
PID:1928 -
\??\c:\pvpjj.exec:\pvpjj.exe60⤵
- Executes dropped EXE
PID:1404 -
\??\c:\flrrllx.exec:\flrrllx.exe61⤵
- Executes dropped EXE
PID:3548 -
\??\c:\bthbth.exec:\bthbth.exe62⤵
- Executes dropped EXE
PID:3680 -
\??\c:\lrfffll.exec:\lrfffll.exe63⤵
- Executes dropped EXE
PID:2328 -
\??\c:\tbthnn.exec:\tbthnn.exe64⤵
- Executes dropped EXE
PID:2628 -
\??\c:\pdjjj.exec:\pdjjj.exe65⤵
- Executes dropped EXE
PID:4052 -
\??\c:\fxrfllf.exec:\fxrfllf.exe66⤵PID:1640
-
\??\c:\nhntht.exec:\nhntht.exe67⤵PID:4124
-
\??\c:\pppjv.exec:\pppjv.exe68⤵PID:1876
-
\??\c:\frxrxxf.exec:\frxrxxf.exe69⤵PID:1460
-
\??\c:\tttbhn.exec:\tttbhn.exe70⤵PID:4212
-
\??\c:\dvjpp.exec:\dvjpp.exe71⤵PID:3628
-
\??\c:\fxlfrlr.exec:\fxlfrlr.exe72⤵PID:3320
-
\??\c:\nbnhbb.exec:\nbnhbb.exe73⤵PID:4796
-
\??\c:\lxxrrll.exec:\lxxrrll.exe74⤵PID:3460
-
\??\c:\ttbttb.exec:\ttbttb.exe75⤵PID:1688
-
\??\c:\ppvvv.exec:\ppvvv.exe76⤵PID:4028
-
\??\c:\vvvvv.exec:\vvvvv.exe77⤵PID:1692
-
\??\c:\rlrrrrx.exec:\rlrrrrx.exe78⤵PID:2368
-
\??\c:\hbbttb.exec:\hbbttb.exe79⤵PID:4452
-
\??\c:\pddpj.exec:\pddpj.exe80⤵PID:1704
-
\??\c:\ffxfxxf.exec:\ffxfxxf.exe81⤵PID:1080
-
\??\c:\thhbtn.exec:\thhbtn.exe82⤵PID:1236
-
\??\c:\pjdjj.exec:\pjdjj.exe83⤵PID:1016
-
\??\c:\flrrrxx.exec:\flrrrxx.exe84⤵PID:1160
-
\??\c:\thhthn.exec:\thhthn.exe85⤵PID:1040
-
\??\c:\ffllxfx.exec:\ffllxfx.exe86⤵PID:832
-
\??\c:\nntthh.exec:\nntthh.exe87⤵PID:2940
-
\??\c:\ppddd.exec:\ppddd.exe88⤵PID:2932
-
\??\c:\frllllr.exec:\frllllr.exe89⤵PID:3128
-
\??\c:\hntbbh.exec:\hntbbh.exe90⤵PID:4036
-
\??\c:\vddpd.exec:\vddpd.exe91⤵PID:4424
-
\??\c:\rrxrrxx.exec:\rrxrrxx.exe92⤵PID:5108
-
\??\c:\hhnttb.exec:\hhnttb.exe93⤵PID:4348
-
\??\c:\vdppj.exec:\vdppj.exe94⤵PID:4852
-
\??\c:\lfrllll.exec:\lfrllll.exe95⤵PID:3880
-
\??\c:\hhnhtt.exec:\hhnhtt.exe96⤵PID:3048
-
\??\c:\bnttnt.exec:\bnttnt.exe97⤵PID:708
-
\??\c:\pjppj.exec:\pjppj.exe98⤵PID:3868
-
\??\c:\ffllrrr.exec:\ffllrrr.exe99⤵
- System Location Discovery: System Language Discovery
PID:3964 -
\??\c:\nhhhtb.exec:\nhhhtb.exe100⤵PID:4252
-
\??\c:\jdpdp.exec:\jdpdp.exe101⤵PID:3180
-
\??\c:\lxrlxxx.exec:\lxrlxxx.exe102⤵PID:2768
-
\??\c:\tnnhth.exec:\tnnhth.exe103⤵PID:3000
-
\??\c:\5jddj.exec:\5jddj.exe104⤵PID:2596
-
\??\c:\rrffrrl.exec:\rrffrrl.exe105⤵PID:3652
-
\??\c:\3ntthh.exec:\3ntthh.exe106⤵PID:1260
-
\??\c:\llfflrx.exec:\llfflrx.exe107⤵PID:4572
-
\??\c:\nhhbbb.exec:\nhhbbb.exe108⤵PID:4772
-
\??\c:\bbnbbb.exec:\bbnbbb.exe109⤵PID:1368
-
\??\c:\ddddd.exec:\ddddd.exe110⤵PID:4868
-
\??\c:\rrrfflr.exec:\rrrfflr.exe111⤵PID:3268
-
\??\c:\nnhbbh.exec:\nnhbbh.exe112⤵PID:2456
-
\??\c:\pvjjj.exec:\pvjjj.exe113⤵PID:2776
-
\??\c:\lrlfllx.exec:\lrlfllx.exe114⤵PID:4788
-
\??\c:\ntnhhn.exec:\ntnhhn.exe115⤵PID:3732
-
\??\c:\1ppjj.exec:\1ppjj.exe116⤵PID:4324
-
\??\c:\llrrxxx.exec:\llrrxxx.exe117⤵PID:1760
-
\??\c:\nbbthb.exec:\nbbthb.exe118⤵PID:4708
-
\??\c:\1pjjv.exec:\1pjjv.exe119⤵PID:2888
-
\??\c:\frxxxxx.exec:\frxxxxx.exe120⤵PID:3464
-
\??\c:\fxlfffx.exec:\fxlfffx.exe121⤵PID:1164
-
\??\c:\tbhntb.exec:\tbhntb.exe122⤵PID:1732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-