Analysis
-
max time kernel
120s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 10:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f4e27f0cf5e87ee6aba140a2d32b7a58358be45d4dc6d5a652825082e1b283b.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
0f4e27f0cf5e87ee6aba140a2d32b7a58358be45d4dc6d5a652825082e1b283b.exe
-
Size
453KB
-
MD5
1d1c89d5e127d67dc6e08adb501458c2
-
SHA1
af44aa3e2a1c92df412b62c50bc19e1376da09a7
-
SHA256
0f4e27f0cf5e87ee6aba140a2d32b7a58358be45d4dc6d5a652825082e1b283b
-
SHA512
dfb2a81bdb67fbc496c7591f9483845c2f3c42b57abdb3165d96c4a6f8f891a9090db13871be095ad8c333574298426fd043a1dbd8a312e41bcbd213a2e03462
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeE:q7Tc2NYHUrAwfMp3CDE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1608-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1936-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2644-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2472-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2268-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1788-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2480-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/340-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/328-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3836-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-972-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-1025-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-1083-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-1105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4336-1351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2764 5bnhhb.exe 468 jvjdp.exe 2088 frxrlfr.exe 3188 bbbttn.exe 1632 jvpjj.exe 2776 ppvpp.exe 4900 7llxrlf.exe 760 nbhhbh.exe 4504 5pppp.exe 4088 lrxrlfx.exe 3524 hbbtnh.exe 3904 fflfxxx.exe 4960 jvddv.exe 4804 htbhth.exe 2984 lxlfxrl.exe 4464 vpvvp.exe 464 frfxlll.exe 5060 djdvd.exe 1936 fxlflrx.exe 4944 xxrrflx.exe 4844 nbhbbt.exe 2644 tthbhb.exe 5000 nhnnhh.exe 2760 3rrfxll.exe 1668 bhnnhh.exe 1820 xffxrrl.exe 1824 tntnhh.exe 2216 pjpjj.exe 2632 3bbntt.exe 1900 9vpjd.exe 4852 tbthnb.exe 452 3vjpd.exe 2640 lfrlfxf.exe 376 pdddv.exe 3940 7pvvp.exe 2872 htbnnh.exe 3668 9vdvp.exe 3684 xxxlfxx.exe 3276 5bhhnt.exe 3264 ntttnt.exe 3968 vpjjd.exe 2472 xffrlxx.exe 1528 bntnnh.exe 1424 pddvp.exe 4704 llllrrr.exe 1832 ttthhn.exe 1580 vvvvj.exe 4392 dddjv.exe 1804 xxxxrll.exe 2304 bthhht.exe 2960 3vvvv.exe 2340 rlrlxrr.exe 4856 nhbtnb.exe 3912 pvvpp.exe 4816 xrxxxxx.exe 2268 tthbhh.exe 2780 1pdvd.exe 2108 lxxrrlf.exe 760 tbhthh.exe 4976 ddpdp.exe 4444 5jpdv.exe 968 rxxxrfr.exe 1788 bbbthn.exe 4220 7pjjd.exe -
resource yara_rule behavioral2/memory/1608-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1936-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2644-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2472-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2268-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1788-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2480-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/340-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2920-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/328-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3836-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-869-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-972-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-1000-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1608 wrote to memory of 2764 1608 0f4e27f0cf5e87ee6aba140a2d32b7a58358be45d4dc6d5a652825082e1b283b.exe 82 PID 1608 wrote to memory of 2764 1608 0f4e27f0cf5e87ee6aba140a2d32b7a58358be45d4dc6d5a652825082e1b283b.exe 82 PID 1608 wrote to memory of 2764 1608 0f4e27f0cf5e87ee6aba140a2d32b7a58358be45d4dc6d5a652825082e1b283b.exe 82 PID 2764 wrote to memory of 468 2764 5bnhhb.exe 83 PID 2764 wrote to memory of 468 2764 5bnhhb.exe 83 PID 2764 wrote to memory of 468 2764 5bnhhb.exe 83 PID 468 wrote to memory of 2088 468 jvjdp.exe 84 PID 468 wrote to memory of 2088 468 jvjdp.exe 84 PID 468 wrote to memory of 2088 468 jvjdp.exe 84 PID 2088 wrote to memory of 3188 2088 frxrlfr.exe 85 PID 2088 wrote to memory of 3188 2088 frxrlfr.exe 85 PID 2088 wrote to memory of 3188 2088 frxrlfr.exe 85 PID 3188 wrote to memory of 1632 3188 bbbttn.exe 86 PID 3188 wrote to memory of 1632 3188 bbbttn.exe 86 PID 3188 wrote to memory of 1632 3188 bbbttn.exe 86 PID 1632 wrote to memory of 2776 1632 jvpjj.exe 87 PID 1632 wrote to memory of 2776 1632 jvpjj.exe 87 PID 1632 wrote to memory of 2776 1632 jvpjj.exe 87 PID 2776 wrote to memory of 4900 2776 ppvpp.exe 88 PID 2776 wrote to memory of 4900 2776 ppvpp.exe 88 PID 2776 wrote to memory of 4900 2776 ppvpp.exe 88 PID 4900 wrote to memory of 760 4900 7llxrlf.exe 89 PID 4900 wrote to memory of 760 4900 7llxrlf.exe 89 PID 4900 wrote to memory of 760 4900 7llxrlf.exe 89 PID 760 wrote to memory of 4504 760 nbhhbh.exe 90 PID 760 wrote to memory of 4504 760 nbhhbh.exe 90 PID 760 wrote to memory of 4504 760 nbhhbh.exe 90 PID 4504 wrote to memory of 4088 4504 5pppp.exe 91 PID 4504 wrote to memory of 4088 4504 5pppp.exe 91 PID 4504 wrote to memory of 4088 4504 5pppp.exe 91 PID 4088 wrote to memory of 3524 4088 lrxrlfx.exe 92 PID 4088 wrote to memory of 3524 4088 lrxrlfx.exe 92 PID 4088 wrote to memory of 3524 4088 lrxrlfx.exe 92 PID 3524 wrote to memory of 3904 3524 hbbtnh.exe 93 PID 3524 wrote to memory of 3904 3524 hbbtnh.exe 93 PID 3524 wrote to memory of 3904 3524 hbbtnh.exe 93 PID 3904 wrote to memory of 4960 3904 fflfxxx.exe 94 PID 3904 wrote to memory of 4960 3904 fflfxxx.exe 94 PID 3904 wrote to memory of 4960 3904 fflfxxx.exe 94 PID 4960 wrote to memory of 4804 4960 jvddv.exe 95 PID 4960 wrote to memory of 4804 4960 jvddv.exe 95 PID 4960 wrote to memory of 4804 4960 jvddv.exe 95 PID 4804 wrote to memory of 2984 4804 htbhth.exe 96 PID 4804 wrote to memory of 2984 4804 htbhth.exe 96 PID 4804 wrote to memory of 2984 4804 htbhth.exe 96 PID 2984 wrote to memory of 4464 2984 lxlfxrl.exe 97 PID 2984 wrote to memory of 4464 2984 lxlfxrl.exe 97 PID 2984 wrote to memory of 4464 2984 lxlfxrl.exe 97 PID 4464 wrote to memory of 464 4464 vpvvp.exe 98 PID 4464 wrote to memory of 464 4464 vpvvp.exe 98 PID 4464 wrote to memory of 464 4464 vpvvp.exe 98 PID 464 wrote to memory of 5060 464 frfxlll.exe 99 PID 464 wrote to memory of 5060 464 frfxlll.exe 99 PID 464 wrote to memory of 5060 464 frfxlll.exe 99 PID 5060 wrote to memory of 1936 5060 djdvd.exe 100 PID 5060 wrote to memory of 1936 5060 djdvd.exe 100 PID 5060 wrote to memory of 1936 5060 djdvd.exe 100 PID 1936 wrote to memory of 4944 1936 fxlflrx.exe 101 PID 1936 wrote to memory of 4944 1936 fxlflrx.exe 101 PID 1936 wrote to memory of 4944 1936 fxlflrx.exe 101 PID 4944 wrote to memory of 4844 4944 xxrrflx.exe 102 PID 4944 wrote to memory of 4844 4944 xxrrflx.exe 102 PID 4944 wrote to memory of 4844 4944 xxrrflx.exe 102 PID 4844 wrote to memory of 2644 4844 nbhbbt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f4e27f0cf5e87ee6aba140a2d32b7a58358be45d4dc6d5a652825082e1b283b.exe"C:\Users\Admin\AppData\Local\Temp\0f4e27f0cf5e87ee6aba140a2d32b7a58358be45d4dc6d5a652825082e1b283b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\5bnhhb.exec:\5bnhhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\jvjdp.exec:\jvjdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\frxrlfr.exec:\frxrlfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\bbbttn.exec:\bbbttn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\jvpjj.exec:\jvpjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\ppvpp.exec:\ppvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\7llxrlf.exec:\7llxrlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\nbhhbh.exec:\nbhhbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\5pppp.exec:\5pppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\hbbtnh.exec:\hbbtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\fflfxxx.exec:\fflfxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\jvddv.exec:\jvddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\htbhth.exec:\htbhth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\lxlfxrl.exec:\lxlfxrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\vpvvp.exec:\vpvvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\frfxlll.exec:\frfxlll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\djdvd.exec:\djdvd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\fxlflrx.exec:\fxlflrx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\xxrrflx.exec:\xxrrflx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\nbhbbt.exec:\nbhbbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\tthbhb.exec:\tthbhb.exe23⤵
- Executes dropped EXE
PID:2644 -
\??\c:\nhnnhh.exec:\nhnnhh.exe24⤵
- Executes dropped EXE
PID:5000 -
\??\c:\3rrfxll.exec:\3rrfxll.exe25⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bhnnhh.exec:\bhnnhh.exe26⤵
- Executes dropped EXE
PID:1668 -
\??\c:\xffxrrl.exec:\xffxrrl.exe27⤵
- Executes dropped EXE
PID:1820 -
\??\c:\tntnhh.exec:\tntnhh.exe28⤵
- Executes dropped EXE
PID:1824 -
\??\c:\pjpjj.exec:\pjpjj.exe29⤵
- Executes dropped EXE
PID:2216 -
\??\c:\3bbntt.exec:\3bbntt.exe30⤵
- Executes dropped EXE
PID:2632 -
\??\c:\9vpjd.exec:\9vpjd.exe31⤵
- Executes dropped EXE
PID:1900 -
\??\c:\tbthnb.exec:\tbthnb.exe32⤵
- Executes dropped EXE
PID:4852 -
\??\c:\3vjpd.exec:\3vjpd.exe33⤵
- Executes dropped EXE
PID:452 -
\??\c:\lfrlfxf.exec:\lfrlfxf.exe34⤵
- Executes dropped EXE
PID:2640 -
\??\c:\pdddv.exec:\pdddv.exe35⤵
- Executes dropped EXE
PID:376 -
\??\c:\7pvvp.exec:\7pvvp.exe36⤵
- Executes dropped EXE
PID:3940 -
\??\c:\htbnnh.exec:\htbnnh.exe37⤵
- Executes dropped EXE
PID:2872 -
\??\c:\9vdvp.exec:\9vdvp.exe38⤵
- Executes dropped EXE
PID:3668 -
\??\c:\xxxlfxx.exec:\xxxlfxx.exe39⤵
- Executes dropped EXE
PID:3684 -
\??\c:\5bhhnt.exec:\5bhhnt.exe40⤵
- Executes dropped EXE
PID:3276 -
\??\c:\ntttnt.exec:\ntttnt.exe41⤵
- Executes dropped EXE
PID:3264 -
\??\c:\vpjjd.exec:\vpjjd.exe42⤵
- Executes dropped EXE
PID:3968 -
\??\c:\xffrlxx.exec:\xffrlxx.exe43⤵
- Executes dropped EXE
PID:2472 -
\??\c:\bntnnh.exec:\bntnnh.exe44⤵
- Executes dropped EXE
PID:1528 -
\??\c:\pddvp.exec:\pddvp.exe45⤵
- Executes dropped EXE
PID:1424 -
\??\c:\llllrrr.exec:\llllrrr.exe46⤵
- Executes dropped EXE
PID:4704 -
\??\c:\ttthhn.exec:\ttthhn.exe47⤵
- Executes dropped EXE
PID:1832 -
\??\c:\vvvvj.exec:\vvvvj.exe48⤵
- Executes dropped EXE
PID:1580 -
\??\c:\dddjv.exec:\dddjv.exe49⤵
- Executes dropped EXE
PID:4392 -
\??\c:\xxxxrll.exec:\xxxxrll.exe50⤵
- Executes dropped EXE
PID:1804 -
\??\c:\bthhht.exec:\bthhht.exe51⤵
- Executes dropped EXE
PID:2304 -
\??\c:\3vvvv.exec:\3vvvv.exe52⤵
- Executes dropped EXE
PID:2960 -
\??\c:\rlrlxrr.exec:\rlrlxrr.exe53⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nhbtnb.exec:\nhbtnb.exe54⤵
- Executes dropped EXE
PID:4856 -
\??\c:\pvvpp.exec:\pvvpp.exe55⤵
- Executes dropped EXE
PID:3912 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe56⤵
- Executes dropped EXE
PID:4816 -
\??\c:\tthbhh.exec:\tthbhh.exe57⤵
- Executes dropped EXE
PID:2268 -
\??\c:\1pdvd.exec:\1pdvd.exe58⤵
- Executes dropped EXE
PID:2780 -
\??\c:\lxxrrlf.exec:\lxxrrlf.exe59⤵
- Executes dropped EXE
PID:2108 -
\??\c:\tbhthh.exec:\tbhthh.exe60⤵
- Executes dropped EXE
PID:760 -
\??\c:\ddpdp.exec:\ddpdp.exe61⤵
- Executes dropped EXE
PID:4976 -
\??\c:\5jpdv.exec:\5jpdv.exe62⤵
- Executes dropped EXE
PID:4444 -
\??\c:\rxxxrfr.exec:\rxxxrfr.exe63⤵
- Executes dropped EXE
PID:968 -
\??\c:\bbbthn.exec:\bbbthn.exe64⤵
- Executes dropped EXE
PID:1788 -
\??\c:\7pjjd.exec:\7pjjd.exe65⤵
- Executes dropped EXE
PID:4220 -
\??\c:\rffxllf.exec:\rffxllf.exe66⤵PID:3252
-
\??\c:\tthnhh.exec:\tthnhh.exe67⤵PID:3692
-
\??\c:\vjppj.exec:\vjppj.exe68⤵PID:2288
-
\??\c:\ppvvp.exec:\ppvvp.exe69⤵PID:2364
-
\??\c:\xlrllfx.exec:\xlrllfx.exe70⤵PID:2476
-
\??\c:\bhbhtt.exec:\bhbhtt.exe71⤵PID:1088
-
\??\c:\vvddj.exec:\vvddj.exe72⤵PID:1880
-
\??\c:\lrfffxx.exec:\lrfffxx.exe73⤵PID:5032
-
\??\c:\bnnhhb.exec:\bnnhhb.exe74⤵PID:1428
-
\??\c:\1jppp.exec:\1jppp.exe75⤵PID:3460
-
\??\c:\lxllffx.exec:\lxllffx.exe76⤵PID:4760
-
\??\c:\fxfxxrl.exec:\fxfxxrl.exe77⤵PID:4700
-
\??\c:\hnhtnh.exec:\hnhtnh.exe78⤵PID:4492
-
\??\c:\jvjpv.exec:\jvjpv.exe79⤵PID:956
-
\??\c:\rflfxfx.exec:\rflfxfx.exe80⤵PID:2800
-
\??\c:\tthbtt.exec:\tthbtt.exe81⤵PID:1048
-
\??\c:\vppdv.exec:\vppdv.exe82⤵PID:2392
-
\??\c:\rffxrlf.exec:\rffxrlf.exe83⤵PID:620
-
\??\c:\ttbtnn.exec:\ttbtnn.exe84⤵PID:2760
-
\??\c:\jddvd.exec:\jddvd.exe85⤵PID:1844
-
\??\c:\rlrlxxr.exec:\rlrlxxr.exe86⤵PID:1820
-
\??\c:\hbhhhh.exec:\hbhhhh.exe87⤵PID:2336
-
\??\c:\nnnbtb.exec:\nnnbtb.exe88⤵PID:4964
-
\??\c:\dvpjd.exec:\dvpjd.exe89⤵PID:4888
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe90⤵PID:3056
-
\??\c:\bnbbtt.exec:\bnbbtt.exe91⤵PID:2248
-
\??\c:\pvddv.exec:\pvddv.exe92⤵PID:1900
-
\??\c:\rfffxrr.exec:\rfffxrr.exe93⤵PID:4852
-
\??\c:\hhbttn.exec:\hhbttn.exe94⤵PID:1244
-
\??\c:\pppjd.exec:\pppjd.exe95⤵PID:2432
-
\??\c:\xllrllf.exec:\xllrllf.exe96⤵PID:1152
-
\??\c:\lflfxfx.exec:\lflfxfx.exe97⤵PID:3344
-
\??\c:\nnhtnt.exec:\nnhtnt.exe98⤵PID:1616
-
\??\c:\dddvp.exec:\dddvp.exe99⤵PID:2480
-
\??\c:\frxrllf.exec:\frxrllf.exe100⤵PID:4008
-
\??\c:\lxxrffx.exec:\lxxrffx.exe101⤵PID:4996
-
\??\c:\3bnnhn.exec:\3bnnhn.exe102⤵PID:3276
-
\??\c:\9jpjj.exec:\9jpjj.exe103⤵PID:4744
-
\??\c:\ffxrlff.exec:\ffxrlff.exe104⤵PID:932
-
\??\c:\3hhbtt.exec:\3hhbtt.exe105⤵PID:5048
-
\??\c:\5ttnnn.exec:\5ttnnn.exe106⤵PID:3964
-
\??\c:\fflfxxr.exec:\fflfxxr.exe107⤵PID:2436
-
\??\c:\flffxxx.exec:\flffxxx.exe108⤵PID:2300
-
\??\c:\hhhbtt.exec:\hhhbtt.exe109⤵PID:340
-
\??\c:\djjjp.exec:\djjjp.exe110⤵PID:4932
-
\??\c:\7flffff.exec:\7flffff.exe111⤵PID:2312
-
\??\c:\htntnb.exec:\htntnb.exe112⤵PID:1804
-
\??\c:\1bbbnb.exec:\1bbbnb.exe113⤵PID:3296
-
\??\c:\jpvdv.exec:\jpvdv.exe114⤵PID:540
-
\??\c:\lxxrffr.exec:\lxxrffr.exe115⤵PID:4556
-
\??\c:\httnhb.exec:\httnhb.exe116⤵PID:2088
-
\??\c:\9jjdv.exec:\9jjdv.exe117⤵PID:4720
-
\??\c:\xlxrlff.exec:\xlxrlff.exe118⤵PID:316
-
\??\c:\nthbbt.exec:\nthbbt.exe119⤵PID:5004
-
\??\c:\5pdvj.exec:\5pdvj.exe120⤵PID:912
-
\??\c:\9flrrrr.exec:\9flrrrr.exe121⤵PID:2920
-
\??\c:\fffrrfx.exec:\fffrrfx.exe122⤵PID:4224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-