Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 14:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4be17f233736f89a26112f7b43494c4d2c313fc058d3637574280f571b841fa0.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
4be17f233736f89a26112f7b43494c4d2c313fc058d3637574280f571b841fa0.exe
-
Size
454KB
-
MD5
919ba2c575933a27b9e27bb2c6cb7de6
-
SHA1
2145c855df4940b535247fa67d1f77eca8229bcc
-
SHA256
4be17f233736f89a26112f7b43494c4d2c313fc058d3637574280f571b841fa0
-
SHA512
dcc6ff1562f06c5f1fbe11ab1380613194d59bc634b2706d6902839177b3a1913f9d70b91ee5ecd12b26ecb4dbf6dcab602a99ed922a2ef20d538b3f9bb7cd33
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAben:q7Tc2NYHUrAwfMp3CDn
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4408-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3704-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/996-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1856-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4652-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2124-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/644-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1840-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3880-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1052-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3640-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/972-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2100-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/836-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/244-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2124-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/832-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-707-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-810-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4160-860-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-985-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-1822-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3992 hbhhhh.exe 2676 7hnhbb.exe 3704 tntttb.exe 4712 5ppjd.exe 2760 lffxrrl.exe 2596 hthbtn.exe 5012 lffrrrr.exe 1856 jjvvj.exe 1952 xrxxrxf.exe 996 3xxrxrr.exe 2476 hnbtnn.exe 3248 1hbtnn.exe 3268 ppvjj.exe 1844 llrlffx.exe 4652 dvjvd.exe 2124 hbnntt.exe 4920 vpddv.exe 832 lfrfxrx.exe 1368 nnnhbt.exe 4824 7bttnn.exe 5020 rrrllll.exe 3304 bnhbbh.exe 3240 9jjjj.exe 644 lflxrxr.exe 4236 tnbthh.exe 1840 pvdvp.exe 4000 3xxrfff.exe 4636 bhnhhh.exe 3232 dvjjp.exe 4428 pjppd.exe 4400 3llfffx.exe 1536 3xxffll.exe 1988 btbtbb.exe 5052 ddvpv.exe 3880 1llfllf.exe 2264 hhtntb.exe 380 nbhhhh.exe 3528 rxxrlfx.exe 4100 1bnhbh.exe 3060 jdpjp.exe 2376 rlxrxff.exe 1432 bhttbb.exe 1052 nnnnhh.exe 2204 ddddv.exe 3640 hbhhtt.exe 4360 pjpjj.exe 4572 5ffffll.exe 4484 7ttnhh.exe 2588 bbnnnt.exe 4220 dpvpj.exe 2428 lxxfrxx.exe 548 nbbbtb.exe 864 httnhh.exe 4308 vpppd.exe 4536 1lrlffx.exe 116 ntbtnn.exe 972 hbnhhh.exe 3872 3pvpp.exe 3532 rflfxff.exe 2260 hhtntn.exe 1564 nthbtb.exe 60 jjpjj.exe 2436 xrxrllf.exe 3496 fxxxrrr.exe -
resource yara_rule behavioral2/memory/4408-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3704-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/996-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1856-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/644-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1840-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3880-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/380-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1052-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/972-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2100-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/836-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3728-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/244-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/832-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-810-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4408 wrote to memory of 3992 4408 4be17f233736f89a26112f7b43494c4d2c313fc058d3637574280f571b841fa0.exe 83 PID 4408 wrote to memory of 3992 4408 4be17f233736f89a26112f7b43494c4d2c313fc058d3637574280f571b841fa0.exe 83 PID 4408 wrote to memory of 3992 4408 4be17f233736f89a26112f7b43494c4d2c313fc058d3637574280f571b841fa0.exe 83 PID 3992 wrote to memory of 2676 3992 hbhhhh.exe 84 PID 3992 wrote to memory of 2676 3992 hbhhhh.exe 84 PID 3992 wrote to memory of 2676 3992 hbhhhh.exe 84 PID 2676 wrote to memory of 3704 2676 7hnhbb.exe 85 PID 2676 wrote to memory of 3704 2676 7hnhbb.exe 85 PID 2676 wrote to memory of 3704 2676 7hnhbb.exe 85 PID 3704 wrote to memory of 4712 3704 tntttb.exe 86 PID 3704 wrote to memory of 4712 3704 tntttb.exe 86 PID 3704 wrote to memory of 4712 3704 tntttb.exe 86 PID 4712 wrote to memory of 2760 4712 5ppjd.exe 87 PID 4712 wrote to memory of 2760 4712 5ppjd.exe 87 PID 4712 wrote to memory of 2760 4712 5ppjd.exe 87 PID 2760 wrote to memory of 2596 2760 lffxrrl.exe 88 PID 2760 wrote to memory of 2596 2760 lffxrrl.exe 88 PID 2760 wrote to memory of 2596 2760 lffxrrl.exe 88 PID 2596 wrote to memory of 5012 2596 hthbtn.exe 89 PID 2596 wrote to memory of 5012 2596 hthbtn.exe 89 PID 2596 wrote to memory of 5012 2596 hthbtn.exe 89 PID 5012 wrote to memory of 1856 5012 lffrrrr.exe 90 PID 5012 wrote to memory of 1856 5012 lffrrrr.exe 90 PID 5012 wrote to memory of 1856 5012 lffrrrr.exe 90 PID 1856 wrote to memory of 1952 1856 jjvvj.exe 91 PID 1856 wrote to memory of 1952 1856 jjvvj.exe 91 PID 1856 wrote to memory of 1952 1856 jjvvj.exe 91 PID 1952 wrote to memory of 996 1952 xrxxrxf.exe 92 PID 1952 wrote to memory of 996 1952 xrxxrxf.exe 92 PID 1952 wrote to memory of 996 1952 xrxxrxf.exe 92 PID 996 wrote to memory of 2476 996 3xxrxrr.exe 93 PID 996 wrote to memory of 2476 996 3xxrxrr.exe 93 PID 996 wrote to memory of 2476 996 3xxrxrr.exe 93 PID 2476 wrote to memory of 3248 2476 hnbtnn.exe 94 PID 2476 wrote to memory of 3248 2476 hnbtnn.exe 94 PID 2476 wrote to memory of 3248 2476 hnbtnn.exe 94 PID 3248 wrote to memory of 3268 3248 1hbtnn.exe 95 PID 3248 wrote to memory of 3268 3248 1hbtnn.exe 95 PID 3248 wrote to memory of 3268 3248 1hbtnn.exe 95 PID 3268 wrote to memory of 1844 3268 ppvjj.exe 96 PID 3268 wrote to memory of 1844 3268 ppvjj.exe 96 PID 3268 wrote to memory of 1844 3268 ppvjj.exe 96 PID 1844 wrote to memory of 4652 1844 llrlffx.exe 97 PID 1844 wrote to memory of 4652 1844 llrlffx.exe 97 PID 1844 wrote to memory of 4652 1844 llrlffx.exe 97 PID 4652 wrote to memory of 2124 4652 dvjvd.exe 98 PID 4652 wrote to memory of 2124 4652 dvjvd.exe 98 PID 4652 wrote to memory of 2124 4652 dvjvd.exe 98 PID 2124 wrote to memory of 4920 2124 hbnntt.exe 99 PID 2124 wrote to memory of 4920 2124 hbnntt.exe 99 PID 2124 wrote to memory of 4920 2124 hbnntt.exe 99 PID 4920 wrote to memory of 832 4920 vpddv.exe 100 PID 4920 wrote to memory of 832 4920 vpddv.exe 100 PID 4920 wrote to memory of 832 4920 vpddv.exe 100 PID 832 wrote to memory of 1368 832 lfrfxrx.exe 101 PID 832 wrote to memory of 1368 832 lfrfxrx.exe 101 PID 832 wrote to memory of 1368 832 lfrfxrx.exe 101 PID 1368 wrote to memory of 4824 1368 nnnhbt.exe 102 PID 1368 wrote to memory of 4824 1368 nnnhbt.exe 102 PID 1368 wrote to memory of 4824 1368 nnnhbt.exe 102 PID 4824 wrote to memory of 5020 4824 7bttnn.exe 103 PID 4824 wrote to memory of 5020 4824 7bttnn.exe 103 PID 4824 wrote to memory of 5020 4824 7bttnn.exe 103 PID 5020 wrote to memory of 3304 5020 rrrllll.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\4be17f233736f89a26112f7b43494c4d2c313fc058d3637574280f571b841fa0.exe"C:\Users\Admin\AppData\Local\Temp\4be17f233736f89a26112f7b43494c4d2c313fc058d3637574280f571b841fa0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\hbhhhh.exec:\hbhhhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\7hnhbb.exec:\7hnhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\tntttb.exec:\tntttb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\5ppjd.exec:\5ppjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\lffxrrl.exec:\lffxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\hthbtn.exec:\hthbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\lffrrrr.exec:\lffrrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\jjvvj.exec:\jjvvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\xrxxrxf.exec:\xrxxrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\3xxrxrr.exec:\3xxrxrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\hnbtnn.exec:\hnbtnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\1hbtnn.exec:\1hbtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\ppvjj.exec:\ppvjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\llrlffx.exec:\llrlffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\dvjvd.exec:\dvjvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\hbnntt.exec:\hbnntt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\vpddv.exec:\vpddv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\lfrfxrx.exec:\lfrfxrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\nnnhbt.exec:\nnnhbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\7bttnn.exec:\7bttnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\rrrllll.exec:\rrrllll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\bnhbbh.exec:\bnhbbh.exe23⤵
- Executes dropped EXE
PID:3304 -
\??\c:\9jjjj.exec:\9jjjj.exe24⤵
- Executes dropped EXE
PID:3240 -
\??\c:\lflxrxr.exec:\lflxrxr.exe25⤵
- Executes dropped EXE
PID:644 -
\??\c:\tnbthh.exec:\tnbthh.exe26⤵
- Executes dropped EXE
PID:4236 -
\??\c:\pvdvp.exec:\pvdvp.exe27⤵
- Executes dropped EXE
PID:1840 -
\??\c:\3xxrfff.exec:\3xxrfff.exe28⤵
- Executes dropped EXE
PID:4000 -
\??\c:\bhnhhh.exec:\bhnhhh.exe29⤵
- Executes dropped EXE
PID:4636 -
\??\c:\dvjjp.exec:\dvjjp.exe30⤵
- Executes dropped EXE
PID:3232 -
\??\c:\pjppd.exec:\pjppd.exe31⤵
- Executes dropped EXE
PID:4428 -
\??\c:\3llfffx.exec:\3llfffx.exe32⤵
- Executes dropped EXE
PID:4400 -
\??\c:\3xxffll.exec:\3xxffll.exe33⤵
- Executes dropped EXE
PID:1536 -
\??\c:\btbtbb.exec:\btbtbb.exe34⤵
- Executes dropped EXE
PID:1988 -
\??\c:\ddvpv.exec:\ddvpv.exe35⤵
- Executes dropped EXE
PID:5052 -
\??\c:\1llfllf.exec:\1llfllf.exe36⤵
- Executes dropped EXE
PID:3880 -
\??\c:\hhtntb.exec:\hhtntb.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2264 -
\??\c:\nbhhhh.exec:\nbhhhh.exe38⤵
- Executes dropped EXE
PID:380 -
\??\c:\rxxrlfx.exec:\rxxrlfx.exe39⤵
- Executes dropped EXE
PID:3528 -
\??\c:\1bnhbh.exec:\1bnhbh.exe40⤵
- Executes dropped EXE
PID:4100 -
\??\c:\jdpjp.exec:\jdpjp.exe41⤵
- Executes dropped EXE
PID:3060 -
\??\c:\rlxrxff.exec:\rlxrxff.exe42⤵
- Executes dropped EXE
PID:2376 -
\??\c:\bhttbb.exec:\bhttbb.exe43⤵
- Executes dropped EXE
PID:1432 -
\??\c:\nnnnhh.exec:\nnnnhh.exe44⤵
- Executes dropped EXE
PID:1052 -
\??\c:\ddddv.exec:\ddddv.exe45⤵
- Executes dropped EXE
PID:2204 -
\??\c:\hbhhtt.exec:\hbhhtt.exe46⤵
- Executes dropped EXE
PID:3640 -
\??\c:\pjpjj.exec:\pjpjj.exe47⤵
- Executes dropped EXE
PID:4360 -
\??\c:\5ffffll.exec:\5ffffll.exe48⤵
- Executes dropped EXE
PID:4572 -
\??\c:\7ttnhh.exec:\7ttnhh.exe49⤵
- Executes dropped EXE
PID:4484 -
\??\c:\bbnnnt.exec:\bbnnnt.exe50⤵
- Executes dropped EXE
PID:2588 -
\??\c:\dpvpj.exec:\dpvpj.exe51⤵
- Executes dropped EXE
PID:4220 -
\??\c:\lxxfrxx.exec:\lxxfrxx.exe52⤵
- Executes dropped EXE
PID:2428 -
\??\c:\nbbbtb.exec:\nbbbtb.exe53⤵
- Executes dropped EXE
PID:548 -
\??\c:\httnhh.exec:\httnhh.exe54⤵
- Executes dropped EXE
PID:864 -
\??\c:\vpppd.exec:\vpppd.exe55⤵
- Executes dropped EXE
PID:4308 -
\??\c:\1lrlffx.exec:\1lrlffx.exe56⤵
- Executes dropped EXE
PID:4536 -
\??\c:\ntbtnn.exec:\ntbtnn.exe57⤵
- Executes dropped EXE
PID:116 -
\??\c:\hbnhhh.exec:\hbnhhh.exe58⤵
- Executes dropped EXE
PID:972 -
\??\c:\3pvpp.exec:\3pvpp.exe59⤵
- Executes dropped EXE
PID:3872 -
\??\c:\rflfxff.exec:\rflfxff.exe60⤵
- Executes dropped EXE
PID:3532 -
\??\c:\hhtntn.exec:\hhtntn.exe61⤵
- Executes dropped EXE
PID:2260 -
\??\c:\nthbtb.exec:\nthbtb.exe62⤵
- Executes dropped EXE
PID:1564 -
\??\c:\jjpjj.exec:\jjpjj.exe63⤵
- Executes dropped EXE
PID:60 -
\??\c:\xrxrllf.exec:\xrxrllf.exe64⤵
- Executes dropped EXE
PID:2436 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe65⤵
- Executes dropped EXE
PID:3496 -
\??\c:\tnbtnn.exec:\tnbtnn.exe66⤵PID:4936
-
\??\c:\vdjjd.exec:\vdjjd.exe67⤵PID:4260
-
\??\c:\xrrlflf.exec:\xrrlflf.exe68⤵PID:1976
-
\??\c:\hhtbtb.exec:\hhtbtb.exe69⤵PID:1532
-
\??\c:\nhnhhh.exec:\nhnhhh.exe70⤵PID:4624
-
\??\c:\llrlffx.exec:\llrlffx.exe71⤵PID:4652
-
\??\c:\rrffllr.exec:\rrffllr.exe72⤵PID:3228
-
\??\c:\nthhhn.exec:\nthhhn.exe73⤵PID:4648
-
\??\c:\9jpvp.exec:\9jpvp.exe74⤵PID:832
-
\??\c:\jjjdv.exec:\jjjdv.exe75⤵PID:2100
-
\??\c:\lflllrr.exec:\lflllrr.exe76⤵PID:372
-
\??\c:\htbntb.exec:\htbntb.exe77⤵PID:4568
-
\??\c:\vjvpp.exec:\vjvpp.exe78⤵PID:2356
-
\??\c:\lfrrllf.exec:\lfrrllf.exe79⤵PID:3008
-
\??\c:\bthhhn.exec:\bthhhn.exe80⤵PID:2796
-
\??\c:\ttbbbb.exec:\ttbbbb.exe81⤵PID:1356
-
\??\c:\djvvj.exec:\djvvj.exe82⤵PID:2096
-
\??\c:\llrxxrr.exec:\llrxxrr.exe83⤵PID:3720
-
\??\c:\1xllfxx.exec:\1xllfxx.exe84⤵PID:836
-
\??\c:\bnbbtb.exec:\bnbbtb.exe85⤵PID:4820
-
\??\c:\5jvpv.exec:\5jvpv.exe86⤵PID:2992
-
\??\c:\xxrlllf.exec:\xxrlllf.exe87⤵PID:4636
-
\??\c:\bnbtnn.exec:\bnbtnn.exe88⤵PID:1616
-
\??\c:\jpdvj.exec:\jpdvj.exe89⤵PID:3696
-
\??\c:\lfllflf.exec:\lfllflf.exe90⤵PID:3676
-
\??\c:\lrfxxxx.exec:\lrfxxxx.exe91⤵PID:1376
-
\??\c:\ntnhbb.exec:\ntnhbb.exe92⤵PID:2700
-
\??\c:\vjvvp.exec:\vjvvp.exe93⤵PID:4856
-
\??\c:\9lfxxrl.exec:\9lfxxrl.exe94⤵PID:2212
-
\??\c:\nnnhbb.exec:\nnnhbb.exe95⤵PID:3728
-
\??\c:\vppjd.exec:\vppjd.exe96⤵PID:4816
-
\??\c:\xflfrrl.exec:\xflfrrl.exe97⤵PID:380
-
\??\c:\bhnhbb.exec:\bhnhbb.exe98⤵PID:3528
-
\??\c:\ttbttt.exec:\ttbttt.exe99⤵PID:992
-
\??\c:\7dpjj.exec:\7dpjj.exe100⤵PID:2880
-
\??\c:\1rxxxxx.exec:\1rxxxxx.exe101⤵PID:2376
-
\??\c:\rllfxrl.exec:\rllfxrl.exe102⤵PID:4528
-
\??\c:\bttnhb.exec:\bttnhb.exe103⤵PID:2408
-
\??\c:\ddjdd.exec:\ddjdd.exe104⤵PID:2544
-
\??\c:\xfrlxxx.exec:\xfrlxxx.exe105⤵PID:244
-
\??\c:\xrxllll.exec:\xrxllll.exe106⤵PID:4692
-
\??\c:\bntttt.exec:\bntttt.exe107⤵PID:740
-
\??\c:\ddjjd.exec:\ddjjd.exe108⤵PID:2936
-
\??\c:\ddjdv.exec:\ddjdv.exe109⤵PID:3260
-
\??\c:\xflfrlf.exec:\xflfrlf.exe110⤵PID:1692
-
\??\c:\thnhbb.exec:\thnhbb.exe111⤵PID:4804
-
\??\c:\7hnnhh.exec:\7hnnhh.exe112⤵PID:840
-
\??\c:\3vvpj.exec:\3vvpj.exe113⤵PID:2500
-
\??\c:\fxflffx.exec:\fxflffx.exe114⤵PID:4524
-
\??\c:\tnnhbb.exec:\tnnhbb.exe115⤵PID:3764
-
\??\c:\ppjpv.exec:\ppjpv.exe116⤵PID:2756
-
\??\c:\vjppj.exec:\vjppj.exe117⤵PID:2016
-
\??\c:\lxllfff.exec:\lxllfff.exe118⤵PID:1856
-
\??\c:\fxlflfl.exec:\fxlflfl.exe119⤵PID:320
-
\??\c:\btbttt.exec:\btbttt.exe120⤵PID:4840
-
\??\c:\dpvpj.exec:\dpvpj.exe121⤵PID:456
-
\??\c:\frxrfff.exec:\frxrfff.exe122⤵PID:4264
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-