Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 10:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c2455cc50ed4f4ca1e86254ea8ab4b9183edcfbc517287e54aa1adaa9ea148c2.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
c2455cc50ed4f4ca1e86254ea8ab4b9183edcfbc517287e54aa1adaa9ea148c2.exe
-
Size
453KB
-
MD5
11e6de8d05dbb69a75dc098f412b831e
-
SHA1
3b1ef06b756c72ce12dfe1d74a5bd24d131d3981
-
SHA256
c2455cc50ed4f4ca1e86254ea8ab4b9183edcfbc517287e54aa1adaa9ea148c2
-
SHA512
81cab794c16b69b0a130ee2496a8a1ef4a02c346d813af771d856c97e22e48f594884986c405815114698aaa878719592a67e831386e97a7cddaf1d6a8fdb55b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeL:q7Tc2NYHUrAwfMp3CDL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4472-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2276-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1148-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1676-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/672-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3068-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1680-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2000-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1868-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1836-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3892-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2516-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2644-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2852-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/752-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1680-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3348-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-647-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2740-670-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-737-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3400-759-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-832-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-851-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-889-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-965-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-996-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3400-1485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1576 hthhhn.exe 2228 btnbbn.exe 4256 nhttnn.exe 824 htbnbn.exe 2728 lrxxxxx.exe 2600 lrxxxfl.exe 3132 vjddv.exe 1564 5xllrxf.exe 1168 bttttt.exe 1824 hnttbh.exe 2276 nnhnbh.exe 1148 hbhhhn.exe 3012 ppddj.exe 2144 nbtbtn.exe 1676 1xflrff.exe 672 htnhhb.exe 4228 rrfffll.exe 2372 dvpvv.exe 3068 fxxflff.exe 2000 1fxffrr.exe 1392 dpjpp.exe 2104 xlxrlll.exe 2932 djpjd.exe 1680 pvjdd.exe 1632 rlrrllf.exe 1772 btbtnh.exe 404 nhnnnn.exe 4696 bnbttb.exe 2804 xxfxlrl.exe 4504 vjjdd.exe 368 7ttnnn.exe 4624 flrlfff.exe 4820 bbbbbn.exe 4368 httnhb.exe 4412 ttttnb.exe 3204 pjdvd.exe 1868 1xrllrl.exe 1036 3thbth.exe 2592 pvjjv.exe 2628 xxxrrrl.exe 532 fflfxxr.exe 3708 dvvpp.exe 1364 jjvpj.exe 3260 lrxxflr.exe 3228 nbbbtb.exe 1836 jjvpv.exe 4640 jdpjj.exe 316 llrfxxr.exe 4976 bhbhhh.exe 4692 djjjv.exe 3892 1fllfff.exe 4668 hbtnnh.exe 3060 dpddp.exe 2516 dddpj.exe 3232 7xxxxxx.exe 4680 htttbh.exe 3348 pjjjj.exe 4964 rlrrlrl.exe 2644 xrxxrrr.exe 1112 tnnhbh.exe 4112 ddjdd.exe 4364 xrflrrx.exe 2632 bbhhbb.exe 2316 ppddp.exe -
resource yara_rule behavioral2/memory/4472-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/824-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2276-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1148-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1676-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/672-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1680-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2000-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1868-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1836-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3892-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2516-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2644-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2852-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/752-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1680-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3832-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1816-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3348-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2740-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-737-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3400-759-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-832-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-851-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-889-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-996-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3btbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfllxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xflrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ntbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4472 wrote to memory of 1576 4472 c2455cc50ed4f4ca1e86254ea8ab4b9183edcfbc517287e54aa1adaa9ea148c2.exe 82 PID 4472 wrote to memory of 1576 4472 c2455cc50ed4f4ca1e86254ea8ab4b9183edcfbc517287e54aa1adaa9ea148c2.exe 82 PID 4472 wrote to memory of 1576 4472 c2455cc50ed4f4ca1e86254ea8ab4b9183edcfbc517287e54aa1adaa9ea148c2.exe 82 PID 1576 wrote to memory of 2228 1576 hthhhn.exe 83 PID 1576 wrote to memory of 2228 1576 hthhhn.exe 83 PID 1576 wrote to memory of 2228 1576 hthhhn.exe 83 PID 2228 wrote to memory of 4256 2228 btnbbn.exe 84 PID 2228 wrote to memory of 4256 2228 btnbbn.exe 84 PID 2228 wrote to memory of 4256 2228 btnbbn.exe 84 PID 4256 wrote to memory of 824 4256 nhttnn.exe 85 PID 4256 wrote to memory of 824 4256 nhttnn.exe 85 PID 4256 wrote to memory of 824 4256 nhttnn.exe 85 PID 824 wrote to memory of 2728 824 htbnbn.exe 86 PID 824 wrote to memory of 2728 824 htbnbn.exe 86 PID 824 wrote to memory of 2728 824 htbnbn.exe 86 PID 2728 wrote to memory of 2600 2728 lrxxxxx.exe 87 PID 2728 wrote to memory of 2600 2728 lrxxxxx.exe 87 PID 2728 wrote to memory of 2600 2728 lrxxxxx.exe 87 PID 2600 wrote to memory of 3132 2600 lrxxxfl.exe 88 PID 2600 wrote to memory of 3132 2600 lrxxxfl.exe 88 PID 2600 wrote to memory of 3132 2600 lrxxxfl.exe 88 PID 3132 wrote to memory of 1564 3132 vjddv.exe 89 PID 3132 wrote to memory of 1564 3132 vjddv.exe 89 PID 3132 wrote to memory of 1564 3132 vjddv.exe 89 PID 1564 wrote to memory of 1168 1564 5xllrxf.exe 90 PID 1564 wrote to memory of 1168 1564 5xllrxf.exe 90 PID 1564 wrote to memory of 1168 1564 5xllrxf.exe 90 PID 1168 wrote to memory of 1824 1168 bttttt.exe 91 PID 1168 wrote to memory of 1824 1168 bttttt.exe 91 PID 1168 wrote to memory of 1824 1168 bttttt.exe 91 PID 1824 wrote to memory of 2276 1824 hnttbh.exe 92 PID 1824 wrote to memory of 2276 1824 hnttbh.exe 92 PID 1824 wrote to memory of 2276 1824 hnttbh.exe 92 PID 2276 wrote to memory of 1148 2276 nnhnbh.exe 93 PID 2276 wrote to memory of 1148 2276 nnhnbh.exe 93 PID 2276 wrote to memory of 1148 2276 nnhnbh.exe 93 PID 1148 wrote to memory of 3012 1148 hbhhhn.exe 94 PID 1148 wrote to memory of 3012 1148 hbhhhn.exe 94 PID 1148 wrote to memory of 3012 1148 hbhhhn.exe 94 PID 3012 wrote to memory of 2144 3012 ppddj.exe 95 PID 3012 wrote to memory of 2144 3012 ppddj.exe 95 PID 3012 wrote to memory of 2144 3012 ppddj.exe 95 PID 2144 wrote to memory of 1676 2144 nbtbtn.exe 96 PID 2144 wrote to memory of 1676 2144 nbtbtn.exe 96 PID 2144 wrote to memory of 1676 2144 nbtbtn.exe 96 PID 1676 wrote to memory of 672 1676 1xflrff.exe 97 PID 1676 wrote to memory of 672 1676 1xflrff.exe 97 PID 1676 wrote to memory of 672 1676 1xflrff.exe 97 PID 672 wrote to memory of 4228 672 htnhhb.exe 98 PID 672 wrote to memory of 4228 672 htnhhb.exe 98 PID 672 wrote to memory of 4228 672 htnhhb.exe 98 PID 4228 wrote to memory of 2372 4228 rrfffll.exe 99 PID 4228 wrote to memory of 2372 4228 rrfffll.exe 99 PID 4228 wrote to memory of 2372 4228 rrfffll.exe 99 PID 2372 wrote to memory of 3068 2372 dvpvv.exe 100 PID 2372 wrote to memory of 3068 2372 dvpvv.exe 100 PID 2372 wrote to memory of 3068 2372 dvpvv.exe 100 PID 3068 wrote to memory of 2000 3068 fxxflff.exe 101 PID 3068 wrote to memory of 2000 3068 fxxflff.exe 101 PID 3068 wrote to memory of 2000 3068 fxxflff.exe 101 PID 2000 wrote to memory of 1392 2000 1fxffrr.exe 102 PID 2000 wrote to memory of 1392 2000 1fxffrr.exe 102 PID 2000 wrote to memory of 1392 2000 1fxffrr.exe 102 PID 1392 wrote to memory of 2104 1392 dpjpp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2455cc50ed4f4ca1e86254ea8ab4b9183edcfbc517287e54aa1adaa9ea148c2.exe"C:\Users\Admin\AppData\Local\Temp\c2455cc50ed4f4ca1e86254ea8ab4b9183edcfbc517287e54aa1adaa9ea148c2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\hthhhn.exec:\hthhhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\btnbbn.exec:\btnbbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\nhttnn.exec:\nhttnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\htbnbn.exec:\htbnbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\lrxxxxx.exec:\lrxxxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\lrxxxfl.exec:\lrxxxfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\vjddv.exec:\vjddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\5xllrxf.exec:\5xllrxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\bttttt.exec:\bttttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\hnttbh.exec:\hnttbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\nnhnbh.exec:\nnhnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\hbhhhn.exec:\hbhhhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\ppddj.exec:\ppddj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\nbtbtn.exec:\nbtbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\1xflrff.exec:\1xflrff.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\htnhhb.exec:\htnhhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\rrfffll.exec:\rrfffll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\dvpvv.exec:\dvpvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\fxxflff.exec:\fxxflff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\1fxffrr.exec:\1fxffrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\dpjpp.exec:\dpjpp.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\xlxrlll.exec:\xlxrlll.exe23⤵
- Executes dropped EXE
PID:2104 -
\??\c:\djpjd.exec:\djpjd.exe24⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pvjdd.exec:\pvjdd.exe25⤵
- Executes dropped EXE
PID:1680 -
\??\c:\rlrrllf.exec:\rlrrllf.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1632 -
\??\c:\btbtnh.exec:\btbtnh.exe27⤵
- Executes dropped EXE
PID:1772 -
\??\c:\nhnnnn.exec:\nhnnnn.exe28⤵
- Executes dropped EXE
PID:404 -
\??\c:\bnbttb.exec:\bnbttb.exe29⤵
- Executes dropped EXE
PID:4696 -
\??\c:\xxfxlrl.exec:\xxfxlrl.exe30⤵
- Executes dropped EXE
PID:2804 -
\??\c:\vjjdd.exec:\vjjdd.exe31⤵
- Executes dropped EXE
PID:4504 -
\??\c:\7ttnnn.exec:\7ttnnn.exe32⤵
- Executes dropped EXE
PID:368 -
\??\c:\flrlfff.exec:\flrlfff.exe33⤵
- Executes dropped EXE
PID:4624 -
\??\c:\bbbbbn.exec:\bbbbbn.exe34⤵
- Executes dropped EXE
PID:4820 -
\??\c:\httnhb.exec:\httnhb.exe35⤵
- Executes dropped EXE
PID:4368 -
\??\c:\ttttnb.exec:\ttttnb.exe36⤵
- Executes dropped EXE
PID:4412 -
\??\c:\pjdvd.exec:\pjdvd.exe37⤵
- Executes dropped EXE
PID:3204 -
\??\c:\1xrllrl.exec:\1xrllrl.exe38⤵
- Executes dropped EXE
PID:1868 -
\??\c:\3thbth.exec:\3thbth.exe39⤵
- Executes dropped EXE
PID:1036 -
\??\c:\pvjjv.exec:\pvjjv.exe40⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xxxrrrl.exec:\xxxrrrl.exe41⤵
- Executes dropped EXE
PID:2628 -
\??\c:\fflfxxr.exec:\fflfxxr.exe42⤵
- Executes dropped EXE
PID:532 -
\??\c:\dvvpp.exec:\dvvpp.exe43⤵
- Executes dropped EXE
PID:3708 -
\??\c:\jjvpj.exec:\jjvpj.exe44⤵
- Executes dropped EXE
PID:1364 -
\??\c:\lrxxflr.exec:\lrxxflr.exe45⤵
- Executes dropped EXE
PID:3260 -
\??\c:\nbbbtb.exec:\nbbbtb.exe46⤵
- Executes dropped EXE
PID:3228 -
\??\c:\jjvpv.exec:\jjvpv.exe47⤵
- Executes dropped EXE
PID:1836 -
\??\c:\jdpjj.exec:\jdpjj.exe48⤵
- Executes dropped EXE
PID:4640 -
\??\c:\llrfxxr.exec:\llrfxxr.exe49⤵
- Executes dropped EXE
PID:316 -
\??\c:\bhbhhh.exec:\bhbhhh.exe50⤵
- Executes dropped EXE
PID:4976 -
\??\c:\djjjv.exec:\djjjv.exe51⤵
- Executes dropped EXE
PID:4692 -
\??\c:\1fllfff.exec:\1fllfff.exe52⤵
- Executes dropped EXE
PID:3892 -
\??\c:\hbtnnh.exec:\hbtnnh.exe53⤵
- Executes dropped EXE
PID:4668 -
\??\c:\dpddp.exec:\dpddp.exe54⤵
- Executes dropped EXE
PID:3060 -
\??\c:\dddpj.exec:\dddpj.exe55⤵
- Executes dropped EXE
PID:2516 -
\??\c:\7xxxxxx.exec:\7xxxxxx.exe56⤵
- Executes dropped EXE
PID:3232 -
\??\c:\htttbh.exec:\htttbh.exe57⤵
- Executes dropped EXE
PID:4680 -
\??\c:\pjjjj.exec:\pjjjj.exe58⤵
- Executes dropped EXE
PID:3348 -
\??\c:\rlrrlrl.exec:\rlrrlrl.exe59⤵
- Executes dropped EXE
PID:4964 -
\??\c:\xrxxrrr.exec:\xrxxrrr.exe60⤵
- Executes dropped EXE
PID:2644 -
\??\c:\tnnhbh.exec:\tnnhbh.exe61⤵
- Executes dropped EXE
PID:1112 -
\??\c:\ddjdd.exec:\ddjdd.exe62⤵
- Executes dropped EXE
PID:4112 -
\??\c:\xrflrrx.exec:\xrflrrx.exe63⤵
- Executes dropped EXE
PID:4364 -
\??\c:\bbhhbb.exec:\bbhhbb.exe64⤵
- Executes dropped EXE
PID:2632 -
\??\c:\ppddp.exec:\ppddp.exe65⤵
- Executes dropped EXE
PID:2316 -
\??\c:\pdpdv.exec:\pdpdv.exe66⤵PID:1428
-
\??\c:\xrxrflf.exec:\xrxrflf.exe67⤵PID:4188
-
\??\c:\ntbbbb.exec:\ntbbbb.exe68⤵PID:2852
-
\??\c:\jddvv.exec:\jddvv.exe69⤵PID:3556
-
\??\c:\1rxrrrl.exec:\1rxrrrl.exe70⤵PID:3012
-
\??\c:\hhnhnt.exec:\hhnhnt.exe71⤵PID:2144
-
\??\c:\3jjjj.exec:\3jjjj.exe72⤵PID:752
-
\??\c:\llrxrff.exec:\llrxrff.exe73⤵PID:2108
-
\??\c:\bbhhnn.exec:\bbhhnn.exe74⤵PID:2076
-
\??\c:\pjvjv.exec:\pjvjv.exe75⤵PID:2084
-
\??\c:\frfffll.exec:\frfffll.exe76⤵PID:976
-
\??\c:\nnbhbh.exec:\nnbhbh.exe77⤵PID:1476
-
\??\c:\hhtttb.exec:\hhtttb.exe78⤵PID:3172
-
\??\c:\pjpjj.exec:\pjpjj.exe79⤵PID:4676
-
\??\c:\rrllrxl.exec:\rrllrxl.exe80⤵PID:2968
-
\??\c:\tnhnnb.exec:\tnhnnb.exe81⤵PID:1392
-
\??\c:\nthhnt.exec:\nthhnt.exe82⤵PID:4360
-
\??\c:\djppp.exec:\djppp.exe83⤵PID:5004
-
\??\c:\lffffff.exec:\lffffff.exe84⤵PID:1908
-
\??\c:\ttnnnn.exec:\ttnnnn.exe85⤵PID:1920
-
\??\c:\vjdvv.exec:\vjdvv.exe86⤵PID:1680
-
\??\c:\rffffrr.exec:\rffffrr.exe87⤵PID:4704
-
\??\c:\5bhhbb.exec:\5bhhbb.exe88⤵PID:1632
-
\??\c:\jdpjj.exec:\jdpjj.exe89⤵PID:1772
-
\??\c:\ddvvp.exec:\ddvvp.exe90⤵PID:860
-
\??\c:\hnbtnn.exec:\hnbtnn.exe91⤵PID:4196
-
\??\c:\vvvvv.exec:\vvvvv.exe92⤵PID:3352
-
\??\c:\xfrllll.exec:\xfrllll.exe93⤵PID:4292
-
\??\c:\xfflflf.exec:\xfflflf.exe94⤵PID:4492
-
\??\c:\ntbtnn.exec:\ntbtnn.exe95⤵PID:5088
-
\??\c:\pjdvj.exec:\pjdvj.exe96⤵PID:2512
-
\??\c:\lffrllf.exec:\lffrllf.exe97⤵PID:4936
-
\??\c:\tthnht.exec:\tthnht.exe98⤵PID:1320
-
\??\c:\dpppj.exec:\dpppj.exe99⤵PID:540
-
\??\c:\frffxxx.exec:\frffxxx.exe100⤵PID:3832
-
\??\c:\nhhbnb.exec:\nhhbnb.exe101⤵PID:5068
-
\??\c:\tnttnn.exec:\tnttnn.exe102⤵PID:3520
-
\??\c:\jjvpp.exec:\jjvpp.exe103⤵PID:4816
-
\??\c:\lrrrrrr.exec:\lrrrrrr.exe104⤵PID:3288
-
\??\c:\nnnhhb.exec:\nnnhhb.exe105⤵PID:5108
-
\??\c:\jjddj.exec:\jjddj.exe106⤵PID:2036
-
\??\c:\fflffll.exec:\fflffll.exe107⤵PID:5012
-
\??\c:\bhntbb.exec:\bhntbb.exe108⤵PID:2672
-
\??\c:\7jpjj.exec:\7jpjj.exe109⤵PID:4672
-
\??\c:\xxrlrlr.exec:\xxrlrlr.exe110⤵PID:4468
-
\??\c:\hnttbh.exec:\hnttbh.exe111⤵PID:4952
-
\??\c:\5pddd.exec:\5pddd.exe112⤵PID:1884
-
\??\c:\lfxrrxx.exec:\lfxrrxx.exe113⤵PID:1744
-
\??\c:\nbhhhn.exec:\nbhhhn.exe114⤵PID:4940
-
\??\c:\vjppp.exec:\vjppp.exe115⤵PID:4812
-
\??\c:\jdppp.exec:\jdppp.exe116⤵PID:1628
-
\??\c:\lfrrrll.exec:\lfrrrll.exe117⤵PID:1596
-
\??\c:\thnnhn.exec:\thnnhn.exe118⤵PID:4976
-
\??\c:\3pdjj.exec:\3pdjj.exe119⤵PID:4692
-
\??\c:\xfxrfff.exec:\xfxrfff.exe120⤵PID:3792
-
\??\c:\3lrrxfl.exec:\3lrrxfl.exe121⤵PID:4000
-
\??\c:\bnbbbb.exec:\bnbbbb.exe122⤵PID:3060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-