Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 21:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
316b27db13ec1d8408e5de53968d482bf3edd1d07d1190af93fcebe39a428cae.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
316b27db13ec1d8408e5de53968d482bf3edd1d07d1190af93fcebe39a428cae.exe
-
Size
453KB
-
MD5
8b5aa080c60765f6220a679d1e6e55e2
-
SHA1
2b062247e10c2e36884b74cd6d6328aa41161633
-
SHA256
316b27db13ec1d8408e5de53968d482bf3edd1d07d1190af93fcebe39a428cae
-
SHA512
59480ea92066b845d0b890881765443e0430feece551557f6e4a11b912c9458094f8b7b6a38c2a4f1a4d59d431dde234b8820d55282d767630d8516ad90dc9a0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/964-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1360-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1340-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2012-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/964-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4248-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2272-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2528-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/508-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/384-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1912-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-549-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-611-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-700-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2652-776-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-792-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-929-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-1355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1360 bhnbtn.exe 3556 lxfxrlf.exe 1068 hhthnb.exe 4844 1ddpd.exe 2968 lflxrrl.exe 4880 vvvpd.exe 1340 3lflxxr.exe 1696 1rlxrlx.exe 2440 xrlfxxr.exe 1672 nhnhhb.exe 3288 dpjvp.exe 4616 nbhtbb.exe 2012 dpppj.exe 4792 xllxrlf.exe 4012 nbhtnh.exe 2212 3pvpp.exe 2464 lxxllfx.exe 2460 xxxrlfx.exe 3744 tnbtbt.exe 1160 vpvpj.exe 2036 rflxrlf.exe 2288 xrrrlrr.exe 4812 bttnhb.exe 4968 vdjjd.exe 1384 xrrlxrx.exe 1048 lxrfxll.exe 3284 1hnhbb.exe 4924 ppdjv.exe 2272 dvvjd.exe 3660 lxlrlrl.exe 4432 nbbbbh.exe 5016 dvpjd.exe 4272 9jpjj.exe 2236 xrrfxxr.exe 448 nhhbtt.exe 4828 thnhbh.exe 2380 pjjdp.exe 4248 dpvjd.exe 4908 9flfffx.exe 3564 bnnhnh.exe 4360 hhthbb.exe 4500 dvvvp.exe 3280 xflxrrx.exe 964 fffxxxr.exe 4872 bbbbtt.exe 3512 ddvdp.exe 4412 rffxrrl.exe 1732 9rxrrxr.exe 4588 tbhtnh.exe 3780 vpvpj.exe 4880 xxfrlfx.exe 2528 tbbtnh.exe 1392 tnbttt.exe 2724 7ppjd.exe 1656 fxlfxrf.exe 1892 3tthbt.exe 2452 djvpj.exe 2060 lfrflff.exe 3796 hhhbbb.exe 3492 9djdp.exe 4604 rflfxrl.exe 3612 9bhbbb.exe 3900 jpvjd.exe 3624 lxxrlfx.exe -
resource yara_rule behavioral2/memory/964-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1360-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1340-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2012-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3780-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/964-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4248-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2272-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2528-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/508-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/384-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1912-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-776-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvvd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 964 wrote to memory of 1360 964 316b27db13ec1d8408e5de53968d482bf3edd1d07d1190af93fcebe39a428cae.exe 83 PID 964 wrote to memory of 1360 964 316b27db13ec1d8408e5de53968d482bf3edd1d07d1190af93fcebe39a428cae.exe 83 PID 964 wrote to memory of 1360 964 316b27db13ec1d8408e5de53968d482bf3edd1d07d1190af93fcebe39a428cae.exe 83 PID 1360 wrote to memory of 3556 1360 bhnbtn.exe 84 PID 1360 wrote to memory of 3556 1360 bhnbtn.exe 84 PID 1360 wrote to memory of 3556 1360 bhnbtn.exe 84 PID 3556 wrote to memory of 1068 3556 lxfxrlf.exe 85 PID 3556 wrote to memory of 1068 3556 lxfxrlf.exe 85 PID 3556 wrote to memory of 1068 3556 lxfxrlf.exe 85 PID 1068 wrote to memory of 4844 1068 hhthnb.exe 86 PID 1068 wrote to memory of 4844 1068 hhthnb.exe 86 PID 1068 wrote to memory of 4844 1068 hhthnb.exe 86 PID 4844 wrote to memory of 2968 4844 1ddpd.exe 87 PID 4844 wrote to memory of 2968 4844 1ddpd.exe 87 PID 4844 wrote to memory of 2968 4844 1ddpd.exe 87 PID 2968 wrote to memory of 4880 2968 lflxrrl.exe 88 PID 2968 wrote to memory of 4880 2968 lflxrrl.exe 88 PID 2968 wrote to memory of 4880 2968 lflxrrl.exe 88 PID 4880 wrote to memory of 1340 4880 vvvpd.exe 89 PID 4880 wrote to memory of 1340 4880 vvvpd.exe 89 PID 4880 wrote to memory of 1340 4880 vvvpd.exe 89 PID 1340 wrote to memory of 1696 1340 3lflxxr.exe 90 PID 1340 wrote to memory of 1696 1340 3lflxxr.exe 90 PID 1340 wrote to memory of 1696 1340 3lflxxr.exe 90 PID 1696 wrote to memory of 2440 1696 1rlxrlx.exe 91 PID 1696 wrote to memory of 2440 1696 1rlxrlx.exe 91 PID 1696 wrote to memory of 2440 1696 1rlxrlx.exe 91 PID 2440 wrote to memory of 1672 2440 xrlfxxr.exe 92 PID 2440 wrote to memory of 1672 2440 xrlfxxr.exe 92 PID 2440 wrote to memory of 1672 2440 xrlfxxr.exe 92 PID 1672 wrote to memory of 3288 1672 nhnhhb.exe 93 PID 1672 wrote to memory of 3288 1672 nhnhhb.exe 93 PID 1672 wrote to memory of 3288 1672 nhnhhb.exe 93 PID 3288 wrote to memory of 4616 3288 dpjvp.exe 94 PID 3288 wrote to memory of 4616 3288 dpjvp.exe 94 PID 3288 wrote to memory of 4616 3288 dpjvp.exe 94 PID 4616 wrote to memory of 2012 4616 nbhtbb.exe 95 PID 4616 wrote to memory of 2012 4616 nbhtbb.exe 95 PID 4616 wrote to memory of 2012 4616 nbhtbb.exe 95 PID 2012 wrote to memory of 4792 2012 dpppj.exe 96 PID 2012 wrote to memory of 4792 2012 dpppj.exe 96 PID 2012 wrote to memory of 4792 2012 dpppj.exe 96 PID 4792 wrote to memory of 4012 4792 xllxrlf.exe 97 PID 4792 wrote to memory of 4012 4792 xllxrlf.exe 97 PID 4792 wrote to memory of 4012 4792 xllxrlf.exe 97 PID 4012 wrote to memory of 2212 4012 nbhtnh.exe 98 PID 4012 wrote to memory of 2212 4012 nbhtnh.exe 98 PID 4012 wrote to memory of 2212 4012 nbhtnh.exe 98 PID 2212 wrote to memory of 2464 2212 3pvpp.exe 99 PID 2212 wrote to memory of 2464 2212 3pvpp.exe 99 PID 2212 wrote to memory of 2464 2212 3pvpp.exe 99 PID 2464 wrote to memory of 2460 2464 lxxllfx.exe 100 PID 2464 wrote to memory of 2460 2464 lxxllfx.exe 100 PID 2464 wrote to memory of 2460 2464 lxxllfx.exe 100 PID 2460 wrote to memory of 3744 2460 xxxrlfx.exe 101 PID 2460 wrote to memory of 3744 2460 xxxrlfx.exe 101 PID 2460 wrote to memory of 3744 2460 xxxrlfx.exe 101 PID 3744 wrote to memory of 1160 3744 tnbtbt.exe 102 PID 3744 wrote to memory of 1160 3744 tnbtbt.exe 102 PID 3744 wrote to memory of 1160 3744 tnbtbt.exe 102 PID 1160 wrote to memory of 2036 1160 vpvpj.exe 103 PID 1160 wrote to memory of 2036 1160 vpvpj.exe 103 PID 1160 wrote to memory of 2036 1160 vpvpj.exe 103 PID 2036 wrote to memory of 2288 2036 rflxrlf.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\316b27db13ec1d8408e5de53968d482bf3edd1d07d1190af93fcebe39a428cae.exe"C:\Users\Admin\AppData\Local\Temp\316b27db13ec1d8408e5de53968d482bf3edd1d07d1190af93fcebe39a428cae.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\bhnbtn.exec:\bhnbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\hhthnb.exec:\hhthnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\1ddpd.exec:\1ddpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\lflxrrl.exec:\lflxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\vvvpd.exec:\vvvpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\3lflxxr.exec:\3lflxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\1rlxrlx.exec:\1rlxrlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\nhnhhb.exec:\nhnhhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\dpjvp.exec:\dpjvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\nbhtbb.exec:\nbhtbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\dpppj.exec:\dpppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\xllxrlf.exec:\xllxrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\nbhtnh.exec:\nbhtnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\3pvpp.exec:\3pvpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\lxxllfx.exec:\lxxllfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\xxxrlfx.exec:\xxxrlfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\tnbtbt.exec:\tnbtbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\vpvpj.exec:\vpvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\rflxrlf.exec:\rflxrlf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\xrrrlrr.exec:\xrrrlrr.exe23⤵
- Executes dropped EXE
PID:2288 -
\??\c:\bttnhb.exec:\bttnhb.exe24⤵
- Executes dropped EXE
PID:4812 -
\??\c:\vdjjd.exec:\vdjjd.exe25⤵
- Executes dropped EXE
PID:4968 -
\??\c:\xrrlxrx.exec:\xrrlxrx.exe26⤵
- Executes dropped EXE
PID:1384 -
\??\c:\lxrfxll.exec:\lxrfxll.exe27⤵
- Executes dropped EXE
PID:1048 -
\??\c:\1hnhbb.exec:\1hnhbb.exe28⤵
- Executes dropped EXE
PID:3284 -
\??\c:\ppdjv.exec:\ppdjv.exe29⤵
- Executes dropped EXE
PID:4924 -
\??\c:\dvvjd.exec:\dvvjd.exe30⤵
- Executes dropped EXE
PID:2272 -
\??\c:\lxlrlrl.exec:\lxlrlrl.exe31⤵
- Executes dropped EXE
PID:3660 -
\??\c:\nbbbbh.exec:\nbbbbh.exe32⤵
- Executes dropped EXE
PID:4432 -
\??\c:\dvpjd.exec:\dvpjd.exe33⤵
- Executes dropped EXE
PID:5016 -
\??\c:\9jpjj.exec:\9jpjj.exe34⤵
- Executes dropped EXE
PID:4272 -
\??\c:\xrrfxxr.exec:\xrrfxxr.exe35⤵
- Executes dropped EXE
PID:2236 -
\??\c:\nhhbtt.exec:\nhhbtt.exe36⤵
- Executes dropped EXE
PID:448 -
\??\c:\thnhbh.exec:\thnhbh.exe37⤵
- Executes dropped EXE
PID:4828 -
\??\c:\pjjdp.exec:\pjjdp.exe38⤵
- Executes dropped EXE
PID:2380 -
\??\c:\dpvjd.exec:\dpvjd.exe39⤵
- Executes dropped EXE
PID:4248 -
\??\c:\9flfffx.exec:\9flfffx.exe40⤵
- Executes dropped EXE
PID:4908 -
\??\c:\bnnhnh.exec:\bnnhnh.exe41⤵
- Executes dropped EXE
PID:3564 -
\??\c:\hhthbb.exec:\hhthbb.exe42⤵
- Executes dropped EXE
PID:4360 -
\??\c:\dvvvp.exec:\dvvvp.exe43⤵
- Executes dropped EXE
PID:4500 -
\??\c:\xflxrrx.exec:\xflxrrx.exe44⤵
- Executes dropped EXE
PID:3280 -
\??\c:\fffxxxr.exec:\fffxxxr.exe45⤵
- Executes dropped EXE
PID:964 -
\??\c:\bbbbtt.exec:\bbbbtt.exe46⤵
- Executes dropped EXE
PID:4872 -
\??\c:\ddvdp.exec:\ddvdp.exe47⤵
- Executes dropped EXE
PID:3512 -
\??\c:\rffxrrl.exec:\rffxrrl.exe48⤵
- Executes dropped EXE
PID:4412 -
\??\c:\9rxrrxr.exec:\9rxrrxr.exe49⤵
- Executes dropped EXE
PID:1732 -
\??\c:\tbhtnh.exec:\tbhtnh.exe50⤵
- Executes dropped EXE
PID:4588 -
\??\c:\vpvpj.exec:\vpvpj.exe51⤵
- Executes dropped EXE
PID:3780 -
\??\c:\xxfrlfx.exec:\xxfrlfx.exe52⤵
- Executes dropped EXE
PID:4880 -
\??\c:\tbbtnh.exec:\tbbtnh.exe53⤵
- Executes dropped EXE
PID:2528 -
\??\c:\tnbttt.exec:\tnbttt.exe54⤵
- Executes dropped EXE
PID:1392 -
\??\c:\7ppjd.exec:\7ppjd.exe55⤵
- Executes dropped EXE
PID:2724 -
\??\c:\fxlfxrf.exec:\fxlfxrf.exe56⤵
- Executes dropped EXE
PID:1656 -
\??\c:\3tthbt.exec:\3tthbt.exe57⤵
- Executes dropped EXE
PID:1892 -
\??\c:\djvpj.exec:\djvpj.exe58⤵
- Executes dropped EXE
PID:2452 -
\??\c:\lfrflff.exec:\lfrflff.exe59⤵
- Executes dropped EXE
PID:2060 -
\??\c:\hhhbbb.exec:\hhhbbb.exe60⤵
- Executes dropped EXE
PID:3796 -
\??\c:\9djdp.exec:\9djdp.exe61⤵
- Executes dropped EXE
PID:3492 -
\??\c:\rflfxrl.exec:\rflfxrl.exe62⤵
- Executes dropped EXE
PID:4604 -
\??\c:\9bhbbb.exec:\9bhbbb.exe63⤵
- Executes dropped EXE
PID:3612 -
\??\c:\jpvjd.exec:\jpvjd.exe64⤵
- Executes dropped EXE
PID:3900 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe65⤵
- Executes dropped EXE
PID:3624 -
\??\c:\pvdvp.exec:\pvdvp.exe66⤵PID:1376
-
\??\c:\3rrlrrl.exec:\3rrlrrl.exe67⤵PID:4792
-
\??\c:\nnnhbb.exec:\nnnhbb.exe68⤵PID:1736
-
\??\c:\jvjdd.exec:\jvjdd.exe69⤵PID:1212
-
\??\c:\lllfxrl.exec:\lllfxrl.exe70⤵PID:3300
-
\??\c:\tthbhh.exec:\tthbhh.exe71⤵PID:2464
-
\??\c:\dvjdv.exec:\dvjdv.exe72⤵PID:508
-
\??\c:\3xlfrrl.exec:\3xlfrrl.exe73⤵PID:1808
-
\??\c:\3btnnn.exec:\3btnnn.exe74⤵PID:2428
-
\??\c:\jvjdd.exec:\jvjdd.exe75⤵PID:5020
-
\??\c:\hnnnhh.exec:\hnnnhh.exe76⤵PID:4540
-
\??\c:\vjpjd.exec:\vjpjd.exe77⤵PID:1716
-
\??\c:\xrxrrlr.exec:\xrxrrlr.exe78⤵
- System Location Discovery: System Language Discovery
PID:2396 -
\??\c:\xfrlffx.exec:\xfrlffx.exe79⤵PID:1536
-
\??\c:\5ttnnn.exec:\5ttnnn.exe80⤵PID:1884
-
\??\c:\pppjj.exec:\pppjj.exe81⤵PID:3236
-
\??\c:\fxxfrrl.exec:\fxxfrrl.exe82⤵PID:1472
-
\??\c:\7nnnhh.exec:\7nnnhh.exe83⤵PID:3436
-
\??\c:\jjvpv.exec:\jjvpv.exe84⤵PID:4884
-
\??\c:\1hbttt.exec:\1hbttt.exe85⤵PID:1628
-
\??\c:\vvddv.exec:\vvddv.exe86⤵PID:4220
-
\??\c:\lfflrlf.exec:\lfflrlf.exe87⤵PID:4572
-
\??\c:\hhhhtb.exec:\hhhhtb.exe88⤵PID:4272
-
\??\c:\dvdpj.exec:\dvdpj.exe89⤵PID:4452
-
\??\c:\xlffxxr.exec:\xlffxxr.exe90⤵PID:544
-
\??\c:\nhtntt.exec:\nhtntt.exe91⤵PID:3992
-
\??\c:\1jvpj.exec:\1jvpj.exe92⤵PID:1992
-
\??\c:\pjvdj.exec:\pjvdj.exe93⤵PID:4248
-
\??\c:\1llfffx.exec:\1llfffx.exe94⤵PID:4816
-
\??\c:\thnbnn.exec:\thnbnn.exe95⤵PID:3652
-
\??\c:\vdpjv.exec:\vdpjv.exe96⤵PID:384
-
\??\c:\lflfxxr.exec:\lflfxxr.exe97⤵PID:1864
-
\??\c:\5rlfxxr.exec:\5rlfxxr.exe98⤵PID:4080
-
\??\c:\tntnhb.exec:\tntnhb.exe99⤵PID:4560
-
\??\c:\jddjj.exec:\jddjj.exe100⤵PID:3280
-
\??\c:\xlrlxxx.exec:\xlrlxxx.exe101⤵PID:4072
-
\??\c:\xlrrllx.exec:\xlrrllx.exe102⤵PID:4772
-
\??\c:\btnbnn.exec:\btnbnn.exe103⤵PID:3512
-
\??\c:\vdvpp.exec:\vdvpp.exe104⤵PID:1276
-
\??\c:\lflfxff.exec:\lflfxff.exe105⤵PID:5056
-
\??\c:\nbhnhn.exec:\nbhnhn.exe106⤵PID:884
-
\??\c:\jdvpj.exec:\jdvpj.exe107⤵PID:3988
-
\??\c:\1jpjd.exec:\1jpjd.exe108⤵PID:1912
-
\??\c:\7rxrllf.exec:\7rxrllf.exe109⤵PID:4944
-
\??\c:\hhhnhh.exec:\hhhnhh.exe110⤵PID:3316
-
\??\c:\pjjdd.exec:\pjjdd.exe111⤵
- System Location Discovery: System Language Discovery
PID:1036 -
\??\c:\djjdv.exec:\djjdv.exe112⤵PID:4800
-
\??\c:\xxxrffl.exec:\xxxrffl.exe113⤵PID:4456
-
\??\c:\1xrlllf.exec:\1xrlllf.exe114⤵PID:1340
-
\??\c:\thbbtt.exec:\thbbtt.exe115⤵
- System Location Discovery: System Language Discovery
PID:2356 -
\??\c:\vjpjv.exec:\vjpjv.exe116⤵PID:3272
-
\??\c:\rrxrlfx.exec:\rrxrlfx.exe117⤵PID:2832
-
\??\c:\bnthbt.exec:\bnthbt.exe118⤵PID:620
-
\??\c:\9tnhbb.exec:\9tnhbb.exe119⤵PID:4512
-
\??\c:\pppdp.exec:\pppdp.exe120⤵PID:1608
-
\??\c:\fllfrrl.exec:\fllfrrl.exe121⤵PID:2060
-
\??\c:\7llfrrl.exec:\7llfrrl.exe122⤵PID:1800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-