Analysis
-
max time kernel
120s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 10:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62eN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62eN.exe
-
Size
454KB
-
MD5
ae56846ea334b9da4d29e64ee3657f20
-
SHA1
48bfb42c918fdb0c8073474603dd1b0c5c0a4c3d
-
SHA256
22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62e
-
SHA512
ac3113845ceb49d1c8e4ba69362b5ab49590677f0186dd1ac74aa4ab8ee2a753f39c528171b8f41e67112426745d3b1bede6f21f28d218619558a670c2703dc2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeq:q7Tc2NYHUrAwfMp3CDq
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3344-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/852-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1288-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1748-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/472-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2896-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1008-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3408-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4160-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2340-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/368-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3640-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3384-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1008-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1132-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3356-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3124-675-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-853-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4612-860-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-938-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-1427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4572 nbnbbt.exe 3412 9dpjd.exe 3724 3xffllf.exe 852 nbhthn.exe 2104 xrrlffx.exe 3168 7xrfrlx.exe 5012 vdpdp.exe 1288 lxrfxlf.exe 2700 xffrflr.exe 3976 btnnbt.exe 2944 pdvdj.exe 1748 3lxlrlf.exe 4340 7nbnbt.exe 1668 1ddpd.exe 544 7xffrlx.exe 3056 3hhtbt.exe 3720 jvpjv.exe 3776 jdjjp.exe 472 9dvjp.exe 368 hbthtn.exe 3660 djjvp.exe 2896 rlxxlll.exe 4228 bnnhbt.exe 1828 frlxlfr.exe 1580 tththt.exe 1048 vppdj.exe 4756 lxxlxlf.exe 3252 nntnbb.exe 1680 bbntbt.exe 4904 ppvjv.exe 4344 7xrfxlf.exe 2744 ththtn.exe 764 1pjjv.exe 3408 ddpvj.exe 1384 xllxlxr.exe 1008 9nnbtn.exe 2728 9nnbbt.exe 4160 dddpj.exe 3220 rfxxlfx.exe 2340 htnnbt.exe 5040 jvpvv.exe 2056 djjvp.exe 1504 xfffrrr.exe 1116 3nbnnn.exe 4044 nhhhnb.exe 3856 frxllfr.exe 3640 bbbnht.exe 2928 dpvpd.exe 4472 rlffrfx.exe 1484 hhbbtt.exe 2232 lxxflxf.exe 4572 xrfrfxl.exe 4528 bntthb.exe 3724 vvvpd.exe 2352 lllxfxr.exe 5020 bnbtnh.exe 1468 vjddp.exe 1976 rfrfxfx.exe 2028 5nbnnh.exe 4100 djppj.exe 2920 bbbnbn.exe 3208 pdvjv.exe 2008 lrxlfxx.exe 4028 xfxrfxr.exe -
resource yara_rule behavioral2/memory/3344-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/852-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/852-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1288-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1748-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/472-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3408-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4160-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2340-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/368-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2920-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1132-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3356-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3124-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-853-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xfrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3344 wrote to memory of 4572 3344 22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62eN.exe 83 PID 3344 wrote to memory of 4572 3344 22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62eN.exe 83 PID 3344 wrote to memory of 4572 3344 22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62eN.exe 83 PID 4572 wrote to memory of 3412 4572 nbnbbt.exe 84 PID 4572 wrote to memory of 3412 4572 nbnbbt.exe 84 PID 4572 wrote to memory of 3412 4572 nbnbbt.exe 84 PID 3412 wrote to memory of 3724 3412 9dpjd.exe 85 PID 3412 wrote to memory of 3724 3412 9dpjd.exe 85 PID 3412 wrote to memory of 3724 3412 9dpjd.exe 85 PID 3724 wrote to memory of 852 3724 3xffllf.exe 86 PID 3724 wrote to memory of 852 3724 3xffllf.exe 86 PID 3724 wrote to memory of 852 3724 3xffllf.exe 86 PID 852 wrote to memory of 2104 852 nbhthn.exe 87 PID 852 wrote to memory of 2104 852 nbhthn.exe 87 PID 852 wrote to memory of 2104 852 nbhthn.exe 87 PID 2104 wrote to memory of 3168 2104 xrrlffx.exe 88 PID 2104 wrote to memory of 3168 2104 xrrlffx.exe 88 PID 2104 wrote to memory of 3168 2104 xrrlffx.exe 88 PID 3168 wrote to memory of 5012 3168 7xrfrlx.exe 89 PID 3168 wrote to memory of 5012 3168 7xrfrlx.exe 89 PID 3168 wrote to memory of 5012 3168 7xrfrlx.exe 89 PID 5012 wrote to memory of 1288 5012 vdpdp.exe 90 PID 5012 wrote to memory of 1288 5012 vdpdp.exe 90 PID 5012 wrote to memory of 1288 5012 vdpdp.exe 90 PID 1288 wrote to memory of 2700 1288 lxrfxlf.exe 91 PID 1288 wrote to memory of 2700 1288 lxrfxlf.exe 91 PID 1288 wrote to memory of 2700 1288 lxrfxlf.exe 91 PID 2700 wrote to memory of 3976 2700 xffrflr.exe 92 PID 2700 wrote to memory of 3976 2700 xffrflr.exe 92 PID 2700 wrote to memory of 3976 2700 xffrflr.exe 92 PID 3976 wrote to memory of 2944 3976 btnnbt.exe 93 PID 3976 wrote to memory of 2944 3976 btnnbt.exe 93 PID 3976 wrote to memory of 2944 3976 btnnbt.exe 93 PID 2944 wrote to memory of 1748 2944 pdvdj.exe 94 PID 2944 wrote to memory of 1748 2944 pdvdj.exe 94 PID 2944 wrote to memory of 1748 2944 pdvdj.exe 94 PID 1748 wrote to memory of 4340 1748 3lxlrlf.exe 95 PID 1748 wrote to memory of 4340 1748 3lxlrlf.exe 95 PID 1748 wrote to memory of 4340 1748 3lxlrlf.exe 95 PID 4340 wrote to memory of 1668 4340 7nbnbt.exe 96 PID 4340 wrote to memory of 1668 4340 7nbnbt.exe 96 PID 4340 wrote to memory of 1668 4340 7nbnbt.exe 96 PID 1668 wrote to memory of 544 1668 1ddpd.exe 97 PID 1668 wrote to memory of 544 1668 1ddpd.exe 97 PID 1668 wrote to memory of 544 1668 1ddpd.exe 97 PID 544 wrote to memory of 3056 544 7xffrlx.exe 98 PID 544 wrote to memory of 3056 544 7xffrlx.exe 98 PID 544 wrote to memory of 3056 544 7xffrlx.exe 98 PID 3056 wrote to memory of 3720 3056 3hhtbt.exe 99 PID 3056 wrote to memory of 3720 3056 3hhtbt.exe 99 PID 3056 wrote to memory of 3720 3056 3hhtbt.exe 99 PID 3720 wrote to memory of 3776 3720 jvpjv.exe 100 PID 3720 wrote to memory of 3776 3720 jvpjv.exe 100 PID 3720 wrote to memory of 3776 3720 jvpjv.exe 100 PID 3776 wrote to memory of 472 3776 jdjjp.exe 101 PID 3776 wrote to memory of 472 3776 jdjjp.exe 101 PID 3776 wrote to memory of 472 3776 jdjjp.exe 101 PID 472 wrote to memory of 368 472 9dvjp.exe 102 PID 472 wrote to memory of 368 472 9dvjp.exe 102 PID 472 wrote to memory of 368 472 9dvjp.exe 102 PID 368 wrote to memory of 3660 368 hbthtn.exe 103 PID 368 wrote to memory of 3660 368 hbthtn.exe 103 PID 368 wrote to memory of 3660 368 hbthtn.exe 103 PID 3660 wrote to memory of 2896 3660 djjvp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62eN.exe"C:\Users\Admin\AppData\Local\Temp\22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\nbnbbt.exec:\nbnbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\9dpjd.exec:\9dpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\3xffllf.exec:\3xffllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\nbhthn.exec:\nbhthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\xrrlffx.exec:\xrrlffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\7xrfrlx.exec:\7xrfrlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\vdpdp.exec:\vdpdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\lxrfxlf.exec:\lxrfxlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\xffrflr.exec:\xffrflr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\btnnbt.exec:\btnnbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\pdvdj.exec:\pdvdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\3lxlrlf.exec:\3lxlrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\7nbnbt.exec:\7nbnbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\1ddpd.exec:\1ddpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\7xffrlx.exec:\7xffrlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\3hhtbt.exec:\3hhtbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\jvpjv.exec:\jvpjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\jdjjp.exec:\jdjjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\9dvjp.exec:\9dvjp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
\??\c:\hbthtn.exec:\hbthtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\djjvp.exec:\djjvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\rlxxlll.exec:\rlxxlll.exe23⤵
- Executes dropped EXE
PID:2896 -
\??\c:\bnnhbt.exec:\bnnhbt.exe24⤵
- Executes dropped EXE
PID:4228 -
\??\c:\frlxlfr.exec:\frlxlfr.exe25⤵
- Executes dropped EXE
PID:1828 -
\??\c:\tththt.exec:\tththt.exe26⤵
- Executes dropped EXE
PID:1580 -
\??\c:\vppdj.exec:\vppdj.exe27⤵
- Executes dropped EXE
PID:1048 -
\??\c:\lxxlxlf.exec:\lxxlxlf.exe28⤵
- Executes dropped EXE
PID:4756 -
\??\c:\nntnbb.exec:\nntnbb.exe29⤵
- Executes dropped EXE
PID:3252 -
\??\c:\bbntbt.exec:\bbntbt.exe30⤵
- Executes dropped EXE
PID:1680 -
\??\c:\ppvjv.exec:\ppvjv.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4904 -
\??\c:\7xrfxlf.exec:\7xrfxlf.exe32⤵
- Executes dropped EXE
PID:4344 -
\??\c:\ththtn.exec:\ththtn.exe33⤵
- Executes dropped EXE
PID:2744 -
\??\c:\1pjjv.exec:\1pjjv.exe34⤵
- Executes dropped EXE
PID:764 -
\??\c:\ddpvj.exec:\ddpvj.exe35⤵
- Executes dropped EXE
PID:3408 -
\??\c:\xllxlxr.exec:\xllxlxr.exe36⤵
- Executes dropped EXE
PID:1384 -
\??\c:\9nnbtn.exec:\9nnbtn.exe37⤵
- Executes dropped EXE
PID:1008 -
\??\c:\9nnbbt.exec:\9nnbbt.exe38⤵
- Executes dropped EXE
PID:2728 -
\??\c:\dddpj.exec:\dddpj.exe39⤵
- Executes dropped EXE
PID:4160 -
\??\c:\rfxxlfx.exec:\rfxxlfx.exe40⤵
- Executes dropped EXE
PID:3220 -
\??\c:\htnnbt.exec:\htnnbt.exe41⤵
- Executes dropped EXE
PID:2340 -
\??\c:\jvpvv.exec:\jvpvv.exe42⤵
- Executes dropped EXE
PID:5040 -
\??\c:\djjvp.exec:\djjvp.exe43⤵
- Executes dropped EXE
PID:2056 -
\??\c:\xfffrrr.exec:\xfffrrr.exe44⤵
- Executes dropped EXE
PID:1504 -
\??\c:\3nbnnn.exec:\3nbnnn.exe45⤵
- Executes dropped EXE
PID:1116 -
\??\c:\nhhhnb.exec:\nhhhnb.exe46⤵
- Executes dropped EXE
PID:4044 -
\??\c:\frxllfr.exec:\frxllfr.exe47⤵
- Executes dropped EXE
PID:3856 -
\??\c:\bbbnht.exec:\bbbnht.exe48⤵
- Executes dropped EXE
PID:3640 -
\??\c:\dpvpd.exec:\dpvpd.exe49⤵
- Executes dropped EXE
PID:2928 -
\??\c:\rlffrfx.exec:\rlffrfx.exe50⤵
- Executes dropped EXE
PID:4472 -
\??\c:\hhbbtt.exec:\hhbbtt.exe51⤵
- Executes dropped EXE
PID:1484 -
\??\c:\lxxflxf.exec:\lxxflxf.exe52⤵
- Executes dropped EXE
PID:2232 -
\??\c:\xrfrfxl.exec:\xrfrfxl.exe53⤵
- Executes dropped EXE
PID:4572 -
\??\c:\bntthb.exec:\bntthb.exe54⤵
- Executes dropped EXE
PID:4528 -
\??\c:\vvvpd.exec:\vvvpd.exe55⤵
- Executes dropped EXE
PID:3724 -
\??\c:\lllxfxr.exec:\lllxfxr.exe56⤵
- Executes dropped EXE
PID:2352 -
\??\c:\bnbtnh.exec:\bnbtnh.exe57⤵
- Executes dropped EXE
PID:5020 -
\??\c:\vjddp.exec:\vjddp.exe58⤵
- Executes dropped EXE
PID:1468 -
\??\c:\rfrfxfx.exec:\rfrfxfx.exe59⤵
- Executes dropped EXE
PID:1976 -
\??\c:\5nbnnh.exec:\5nbnnh.exe60⤵
- Executes dropped EXE
PID:2028 -
\??\c:\djppj.exec:\djppj.exe61⤵
- Executes dropped EXE
PID:4100 -
\??\c:\bbbnbn.exec:\bbbnbn.exe62⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pdvjv.exec:\pdvjv.exe63⤵
- Executes dropped EXE
PID:3208 -
\??\c:\lrxlfxx.exec:\lrxlfxx.exe64⤵
- Executes dropped EXE
PID:2008 -
\??\c:\xfxrfxr.exec:\xfxrfxr.exe65⤵
- Executes dropped EXE
PID:4028 -
\??\c:\bhnhbb.exec:\bhnhbb.exe66⤵PID:3148
-
\??\c:\djpdp.exec:\djpdp.exe67⤵PID:444
-
\??\c:\vdjvj.exec:\vdjvj.exe68⤵PID:1748
-
\??\c:\7xxfrlx.exec:\7xxfrlx.exe69⤵PID:3556
-
\??\c:\bnthtb.exec:\bnthtb.exe70⤵PID:908
-
\??\c:\vjdvp.exec:\vjdvp.exe71⤵PID:1796
-
\??\c:\pjjvj.exec:\pjjvj.exe72⤵PID:544
-
\??\c:\lxxlxlf.exec:\lxxlxlf.exe73⤵PID:2408
-
\??\c:\bbntnh.exec:\bbntnh.exe74⤵
- System Location Discovery: System Language Discovery
PID:1732 -
\??\c:\vpdpv.exec:\vpdpv.exe75⤵PID:3536
-
\??\c:\xfxrxrf.exec:\xfxrxrf.exe76⤵PID:3384
-
\??\c:\3hhbtn.exec:\3hhbtn.exe77⤵PID:3100
-
\??\c:\dpjvj.exec:\dpjvj.exe78⤵PID:1884
-
\??\c:\xxxrxrl.exec:\xxxrxrl.exe79⤵PID:3004
-
\??\c:\3fxlxrf.exec:\3fxlxrf.exe80⤵PID:844
-
\??\c:\3nnbtn.exec:\3nnbtn.exe81⤵PID:2896
-
\??\c:\vvdpd.exec:\vvdpd.exe82⤵PID:2172
-
\??\c:\llflrlx.exec:\llflrlx.exe83⤵PID:3604
-
\??\c:\lrrlxxr.exec:\lrrlxxr.exe84⤵PID:1828
-
\??\c:\3bthtb.exec:\3bthtb.exe85⤵PID:1580
-
\??\c:\9tnhtn.exec:\9tnhtn.exe86⤵PID:2716
-
\??\c:\ddjjj.exec:\ddjjj.exe87⤵PID:3240
-
\??\c:\3fxlxrf.exec:\3fxlxrf.exe88⤵PID:5036
-
\??\c:\bthbnh.exec:\bthbnh.exe89⤵PID:1768
-
\??\c:\1pdvj.exec:\1pdvj.exe90⤵PID:1356
-
\??\c:\9fflxrf.exec:\9fflxrf.exe91⤵PID:4664
-
\??\c:\xfrlxlf.exec:\xfrlxlf.exe92⤵PID:3340
-
\??\c:\9pddv.exec:\9pddv.exe93⤵PID:2868
-
\??\c:\5pjjp.exec:\5pjjp.exe94⤵PID:3708
-
\??\c:\xrrrfxl.exec:\xrrrfxl.exe95⤵PID:2436
-
\??\c:\1hnnhn.exec:\1hnnhn.exe96⤵PID:2888
-
\??\c:\1vdvv.exec:\1vdvv.exe97⤵PID:3288
-
\??\c:\1rrflfr.exec:\1rrflfr.exe98⤵PID:440
-
\??\c:\hthbtb.exec:\hthbtb.exe99⤵PID:1008
-
\??\c:\hhhbhn.exec:\hhhbhn.exe100⤵PID:1152
-
\??\c:\vjvpv.exec:\vjvpv.exe101⤵PID:2708
-
\??\c:\rllxrll.exec:\rllxrll.exe102⤵PID:748
-
\??\c:\nttnht.exec:\nttnht.exe103⤵PID:2124
-
\??\c:\bttttn.exec:\bttttn.exe104⤵PID:216
-
\??\c:\pjjdp.exec:\pjjdp.exe105⤵PID:2448
-
\??\c:\fxffrll.exec:\fxffrll.exe106⤵PID:3460
-
\??\c:\xrfrrll.exec:\xrfrrll.exe107⤵PID:1504
-
\??\c:\nnnhnn.exec:\nnnhnn.exe108⤵PID:2880
-
\??\c:\pddvp.exec:\pddvp.exe109⤵PID:3520
-
\??\c:\vvdpj.exec:\vvdpj.exe110⤵PID:2132
-
\??\c:\rrxlxrf.exec:\rrxlxrf.exe111⤵PID:2644
-
\??\c:\5bbnnn.exec:\5bbnnn.exe112⤵PID:4876
-
\??\c:\9jdvj.exec:\9jdvj.exe113⤵PID:4448
-
\??\c:\lflxxrr.exec:\lflxxrr.exe114⤵PID:4472
-
\??\c:\9llfxff.exec:\9llfxff.exe115⤵PID:1484
-
\??\c:\ntnnht.exec:\ntnnht.exe116⤵PID:5016
-
\??\c:\9dvjv.exec:\9dvjv.exe117⤵PID:2032
-
\??\c:\1xrlxlx.exec:\1xrlxlx.exe118⤵PID:4528
-
\??\c:\9nbtnn.exec:\9nbtnn.exe119⤵PID:320
-
\??\c:\1hhbtt.exec:\1hhbtt.exe120⤵PID:4464
-
\??\c:\5frlffl.exec:\5frlffl.exe121⤵PID:772
-
\??\c:\3bhbnh.exec:\3bhbnh.exe122⤵PID:3484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-