Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2024, 19:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
04fe86872c8dd4b19378185ce6aead43f38a90fb8222283d0d3e2aa865c2672f.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
04fe86872c8dd4b19378185ce6aead43f38a90fb8222283d0d3e2aa865c2672f.exe
-
Size
456KB
-
MD5
025868b73b36cfd494e17f00285473d0
-
SHA1
d56205cc485eaf9106f45f6205c7184a76d16b70
-
SHA256
04fe86872c8dd4b19378185ce6aead43f38a90fb8222283d0d3e2aa865c2672f
-
SHA512
8f2df192b1c123779e7a2eb7b69be02c6771e470352f5b23853514ccfe54d707d7db7ff41859df4afbba8682c50d90335a7dcb2e932761a7342673ee781d1dcd
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRD:q7Tc2NYHUrAwfMp3CDRD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2668-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4164-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2276-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1388-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3812-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1756-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1756-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1228-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3068-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2668-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1280-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3192-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3288-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1508-667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-904-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-1026-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2260 hbbtnn.exe 4992 7vjdp.exe 4164 xrlfrrl.exe 4600 9btnhh.exe 4800 1bhhbt.exe 3688 djpjv.exe 380 flrlfxr.exe 4388 3vvpd.exe 2276 lfxrrrl.exe 2572 7jjdv.exe 3660 rffxlrl.exe 1388 1jpvp.exe 1752 nhbtnh.exe 4296 pjdpj.exe 4884 5rxrrrx.exe 3552 jdjpj.exe 4648 fxxrrrl.exe 3076 tnhbbt.exe 1456 1jdvp.exe 3904 9lrlffx.exe 1528 rrlxrfx.exe 4780 tnnhbt.exe 4240 9dpdp.exe 1408 fllfxxx.exe 3464 bhnnnh.exe 3812 1hbthb.exe 4620 dpjdv.exe 4824 9hbntt.exe 824 jvjdp.exe 1756 fxxrrrl.exe 2792 rxfxlrf.exe 1228 tbhbtt.exe 4168 1nnhtt.exe 2804 7xxrllf.exe 4444 rlflfff.exe 4960 5bbtnh.exe 1984 jvdvj.exe 4708 frxrlll.exe 4404 dddvp.exe 4084 frrlllr.exe 2928 bhhbtt.exe 3208 vddvd.exe 2840 rllfrrl.exe 3068 xxxxrrl.exe 1484 ttbtnn.exe 940 pvvvj.exe 4472 5ffxrrl.exe 1508 xllfrrl.exe 4504 thnnhh.exe 4072 vvppd.exe 2668 1dvdp.exe 4052 xfxfrfl.exe 2832 nhbhbh.exe 4244 dpjvd.exe 224 pvvpd.exe 3840 rrfrffx.exe 3940 nhbhbb.exe 2484 ttnhth.exe 852 ppdpd.exe 1280 1ffrxrf.exe 3432 9hbtnh.exe 2788 9vdpd.exe 3192 vjpdv.exe 5036 rxfrffr.exe -
resource yara_rule behavioral2/memory/2668-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/380-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2276-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1388-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1756-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1756-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2668-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1280-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3192-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3288-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/380-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1508-667-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xlxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2668 wrote to memory of 2260 2668 04fe86872c8dd4b19378185ce6aead43f38a90fb8222283d0d3e2aa865c2672f.exe 83 PID 2668 wrote to memory of 2260 2668 04fe86872c8dd4b19378185ce6aead43f38a90fb8222283d0d3e2aa865c2672f.exe 83 PID 2668 wrote to memory of 2260 2668 04fe86872c8dd4b19378185ce6aead43f38a90fb8222283d0d3e2aa865c2672f.exe 83 PID 2260 wrote to memory of 4992 2260 hbbtnn.exe 84 PID 2260 wrote to memory of 4992 2260 hbbtnn.exe 84 PID 2260 wrote to memory of 4992 2260 hbbtnn.exe 84 PID 4992 wrote to memory of 4164 4992 7vjdp.exe 85 PID 4992 wrote to memory of 4164 4992 7vjdp.exe 85 PID 4992 wrote to memory of 4164 4992 7vjdp.exe 85 PID 4164 wrote to memory of 4600 4164 xrlfrrl.exe 86 PID 4164 wrote to memory of 4600 4164 xrlfrrl.exe 86 PID 4164 wrote to memory of 4600 4164 xrlfrrl.exe 86 PID 4600 wrote to memory of 4800 4600 9btnhh.exe 87 PID 4600 wrote to memory of 4800 4600 9btnhh.exe 87 PID 4600 wrote to memory of 4800 4600 9btnhh.exe 87 PID 4800 wrote to memory of 3688 4800 1bhhbt.exe 88 PID 4800 wrote to memory of 3688 4800 1bhhbt.exe 88 PID 4800 wrote to memory of 3688 4800 1bhhbt.exe 88 PID 3688 wrote to memory of 380 3688 djpjv.exe 89 PID 3688 wrote to memory of 380 3688 djpjv.exe 89 PID 3688 wrote to memory of 380 3688 djpjv.exe 89 PID 380 wrote to memory of 4388 380 flrlfxr.exe 90 PID 380 wrote to memory of 4388 380 flrlfxr.exe 90 PID 380 wrote to memory of 4388 380 flrlfxr.exe 90 PID 4388 wrote to memory of 2276 4388 3vvpd.exe 91 PID 4388 wrote to memory of 2276 4388 3vvpd.exe 91 PID 4388 wrote to memory of 2276 4388 3vvpd.exe 91 PID 2276 wrote to memory of 2572 2276 lfxrrrl.exe 92 PID 2276 wrote to memory of 2572 2276 lfxrrrl.exe 92 PID 2276 wrote to memory of 2572 2276 lfxrrrl.exe 92 PID 2572 wrote to memory of 3660 2572 7jjdv.exe 93 PID 2572 wrote to memory of 3660 2572 7jjdv.exe 93 PID 2572 wrote to memory of 3660 2572 7jjdv.exe 93 PID 3660 wrote to memory of 1388 3660 rffxlrl.exe 94 PID 3660 wrote to memory of 1388 3660 rffxlrl.exe 94 PID 3660 wrote to memory of 1388 3660 rffxlrl.exe 94 PID 1388 wrote to memory of 1752 1388 1jpvp.exe 95 PID 1388 wrote to memory of 1752 1388 1jpvp.exe 95 PID 1388 wrote to memory of 1752 1388 1jpvp.exe 95 PID 1752 wrote to memory of 4296 1752 nhbtnh.exe 96 PID 1752 wrote to memory of 4296 1752 nhbtnh.exe 96 PID 1752 wrote to memory of 4296 1752 nhbtnh.exe 96 PID 4296 wrote to memory of 4884 4296 pjdpj.exe 97 PID 4296 wrote to memory of 4884 4296 pjdpj.exe 97 PID 4296 wrote to memory of 4884 4296 pjdpj.exe 97 PID 4884 wrote to memory of 3552 4884 5rxrrrx.exe 98 PID 4884 wrote to memory of 3552 4884 5rxrrrx.exe 98 PID 4884 wrote to memory of 3552 4884 5rxrrrx.exe 98 PID 3552 wrote to memory of 4648 3552 jdjpj.exe 99 PID 3552 wrote to memory of 4648 3552 jdjpj.exe 99 PID 3552 wrote to memory of 4648 3552 jdjpj.exe 99 PID 4648 wrote to memory of 3076 4648 fxxrrrl.exe 100 PID 4648 wrote to memory of 3076 4648 fxxrrrl.exe 100 PID 4648 wrote to memory of 3076 4648 fxxrrrl.exe 100 PID 3076 wrote to memory of 1456 3076 tnhbbt.exe 101 PID 3076 wrote to memory of 1456 3076 tnhbbt.exe 101 PID 3076 wrote to memory of 1456 3076 tnhbbt.exe 101 PID 1456 wrote to memory of 3904 1456 1jdvp.exe 102 PID 1456 wrote to memory of 3904 1456 1jdvp.exe 102 PID 1456 wrote to memory of 3904 1456 1jdvp.exe 102 PID 3904 wrote to memory of 1528 3904 9lrlffx.exe 103 PID 3904 wrote to memory of 1528 3904 9lrlffx.exe 103 PID 3904 wrote to memory of 1528 3904 9lrlffx.exe 103 PID 1528 wrote to memory of 4780 1528 rrlxrfx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\04fe86872c8dd4b19378185ce6aead43f38a90fb8222283d0d3e2aa865c2672f.exe"C:\Users\Admin\AppData\Local\Temp\04fe86872c8dd4b19378185ce6aead43f38a90fb8222283d0d3e2aa865c2672f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\hbbtnn.exec:\hbbtnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\7vjdp.exec:\7vjdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\xrlfrrl.exec:\xrlfrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\9btnhh.exec:\9btnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\1bhhbt.exec:\1bhhbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\djpjv.exec:\djpjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\flrlfxr.exec:\flrlfxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\3vvpd.exec:\3vvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\lfxrrrl.exec:\lfxrrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\7jjdv.exec:\7jjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\rffxlrl.exec:\rffxlrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\1jpvp.exec:\1jpvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\nhbtnh.exec:\nhbtnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\pjdpj.exec:\pjdpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\5rxrrrx.exec:\5rxrrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\jdjpj.exec:\jdjpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\tnhbbt.exec:\tnhbbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\1jdvp.exec:\1jdvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\9lrlffx.exec:\9lrlffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\rrlxrfx.exec:\rrlxrfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\tnnhbt.exec:\tnnhbt.exe23⤵
- Executes dropped EXE
PID:4780 -
\??\c:\9dpdp.exec:\9dpdp.exe24⤵
- Executes dropped EXE
PID:4240 -
\??\c:\fllfxxx.exec:\fllfxxx.exe25⤵
- Executes dropped EXE
PID:1408 -
\??\c:\bhnnnh.exec:\bhnnnh.exe26⤵
- Executes dropped EXE
PID:3464 -
\??\c:\1hbthb.exec:\1hbthb.exe27⤵
- Executes dropped EXE
PID:3812 -
\??\c:\dpjdv.exec:\dpjdv.exe28⤵
- Executes dropped EXE
PID:4620 -
\??\c:\9hbntt.exec:\9hbntt.exe29⤵
- Executes dropped EXE
PID:4824 -
\??\c:\jvjdp.exec:\jvjdp.exe30⤵
- Executes dropped EXE
PID:824 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe31⤵
- Executes dropped EXE
PID:1756 -
\??\c:\rxfxlrf.exec:\rxfxlrf.exe32⤵
- Executes dropped EXE
PID:2792 -
\??\c:\tbhbtt.exec:\tbhbtt.exe33⤵
- Executes dropped EXE
PID:1228 -
\??\c:\1nnhtt.exec:\1nnhtt.exe34⤵
- Executes dropped EXE
PID:4168 -
\??\c:\7xxrllf.exec:\7xxrllf.exe35⤵
- Executes dropped EXE
PID:2804 -
\??\c:\rlflfff.exec:\rlflfff.exe36⤵
- Executes dropped EXE
PID:4444 -
\??\c:\5bbtnh.exec:\5bbtnh.exe37⤵
- Executes dropped EXE
PID:4960 -
\??\c:\jvdvj.exec:\jvdvj.exe38⤵
- Executes dropped EXE
PID:1984 -
\??\c:\frxrlll.exec:\frxrlll.exe39⤵
- Executes dropped EXE
PID:4708 -
\??\c:\dddvp.exec:\dddvp.exe40⤵
- Executes dropped EXE
PID:4404 -
\??\c:\frrlllr.exec:\frrlllr.exe41⤵
- Executes dropped EXE
PID:4084 -
\??\c:\bhhbtt.exec:\bhhbtt.exe42⤵
- Executes dropped EXE
PID:2928 -
\??\c:\vddvd.exec:\vddvd.exe43⤵
- Executes dropped EXE
PID:3208 -
\??\c:\rllfrrl.exec:\rllfrrl.exe44⤵
- Executes dropped EXE
PID:2840 -
\??\c:\xxxxrrl.exec:\xxxxrrl.exe45⤵
- Executes dropped EXE
PID:3068 -
\??\c:\ttbtnn.exec:\ttbtnn.exe46⤵
- Executes dropped EXE
PID:1484 -
\??\c:\pvvvj.exec:\pvvvj.exe47⤵
- Executes dropped EXE
PID:940 -
\??\c:\5ffxrrl.exec:\5ffxrrl.exe48⤵
- Executes dropped EXE
PID:4472 -
\??\c:\xllfrrl.exec:\xllfrrl.exe49⤵
- Executes dropped EXE
PID:1508 -
\??\c:\thnnhh.exec:\thnnhh.exe50⤵
- Executes dropped EXE
PID:4504 -
\??\c:\vvppd.exec:\vvppd.exe51⤵
- Executes dropped EXE
PID:4072 -
\??\c:\1dvdp.exec:\1dvdp.exe52⤵
- Executes dropped EXE
PID:2668 -
\??\c:\xfxfrfl.exec:\xfxfrfl.exe53⤵
- Executes dropped EXE
PID:4052 -
\??\c:\nhbhbh.exec:\nhbhbh.exe54⤵
- Executes dropped EXE
PID:2832 -
\??\c:\dpjvd.exec:\dpjvd.exe55⤵
- Executes dropped EXE
PID:4244 -
\??\c:\pvvpd.exec:\pvvpd.exe56⤵
- Executes dropped EXE
PID:224 -
\??\c:\rrfrffx.exec:\rrfrffx.exe57⤵
- Executes dropped EXE
PID:3840 -
\??\c:\nhbhbb.exec:\nhbhbb.exe58⤵
- Executes dropped EXE
PID:3940 -
\??\c:\ttnhth.exec:\ttnhth.exe59⤵
- Executes dropped EXE
PID:2484 -
\??\c:\ppdpd.exec:\ppdpd.exe60⤵
- Executes dropped EXE
PID:852 -
\??\c:\1ffrxrf.exec:\1ffrxrf.exe61⤵
- Executes dropped EXE
PID:1280 -
\??\c:\9hbtnh.exec:\9hbtnh.exe62⤵
- Executes dropped EXE
PID:3432 -
\??\c:\9vdpd.exec:\9vdpd.exe63⤵
- Executes dropped EXE
PID:2788 -
\??\c:\vjpdv.exec:\vjpdv.exe64⤵
- Executes dropped EXE
PID:3192 -
\??\c:\rxfrffr.exec:\rxfrffr.exe65⤵
- Executes dropped EXE
PID:5036 -
\??\c:\btnhbb.exec:\btnhbb.exe66⤵PID:4396
-
\??\c:\nhhtht.exec:\nhhtht.exe67⤵PID:4156
-
\??\c:\pdjdd.exec:\pdjdd.exe68⤵PID:464
-
\??\c:\5flfxxr.exec:\5flfxxr.exe69⤵PID:220
-
\??\c:\1fxxrrl.exec:\1fxxrrl.exe70⤵PID:1752
-
\??\c:\tnnbth.exec:\tnnbth.exe71⤵PID:1340
-
\??\c:\pddvp.exec:\pddvp.exe72⤵PID:1192
-
\??\c:\3rlfxxr.exec:\3rlfxxr.exe73⤵PID:1440
-
\??\c:\7xxrfrf.exec:\7xxrfrf.exe74⤵PID:4152
-
\??\c:\bhnbtt.exec:\bhnbtt.exe75⤵PID:3304
-
\??\c:\vdvjd.exec:\vdvjd.exe76⤵PID:992
-
\??\c:\htbthh.exec:\htbthh.exe77⤵PID:528
-
\??\c:\9tnbhb.exec:\9tnbhb.exe78⤵PID:4864
-
\??\c:\pvpdj.exec:\pvpdj.exe79⤵PID:640
-
\??\c:\rrxrllf.exec:\rrxrllf.exe80⤵PID:4720
-
\??\c:\thnbtb.exec:\thnbtb.exe81⤵PID:2140
-
\??\c:\thhbtb.exec:\thhbtb.exe82⤵PID:4048
-
\??\c:\jvvpd.exec:\jvvpd.exe83⤵PID:2912
-
\??\c:\rlxllff.exec:\rlxllff.exe84⤵PID:4240
-
\??\c:\bttnhh.exec:\bttnhh.exe85⤵PID:4428
-
\??\c:\3dvjd.exec:\3dvjd.exe86⤵PID:2476
-
\??\c:\frlxfxl.exec:\frlxfxl.exe87⤵PID:2844
-
\??\c:\rrrxllf.exec:\rrrxllf.exe88⤵PID:1652
-
\??\c:\thtnhb.exec:\thtnhb.exe89⤵PID:3328
-
\??\c:\7djpd.exec:\7djpd.exe90⤵PID:4824
-
\??\c:\ppdvj.exec:\ppdvj.exe91⤵PID:2580
-
\??\c:\rfxlxrf.exec:\rfxlxrf.exe92⤵PID:968
-
\??\c:\thtbtn.exec:\thtbtn.exe93⤵PID:3644
-
\??\c:\vjdvj.exec:\vjdvj.exe94⤵PID:3156
-
\??\c:\1ppdp.exec:\1ppdp.exe95⤵PID:3620
-
\??\c:\fxfxffr.exec:\fxfxffr.exe96⤵PID:3576
-
\??\c:\htbhtn.exec:\htbhtn.exe97⤵PID:1524
-
\??\c:\9jdjp.exec:\9jdjp.exe98⤵PID:1784
-
\??\c:\pdpdv.exec:\pdpdv.exe99⤵PID:1596
-
\??\c:\xxfrrrl.exec:\xxfrrrl.exe100⤵PID:312
-
\??\c:\tbhbtt.exec:\tbhbtt.exe101⤵PID:3724
-
\??\c:\3tbhnb.exec:\3tbhnb.exe102⤵PID:1984
-
\??\c:\jvpjj.exec:\jvpjj.exe103⤵PID:4708
-
\??\c:\rfflxlx.exec:\rfflxlx.exe104⤵PID:4404
-
\??\c:\rfllfff.exec:\rfllfff.exe105⤵PID:4920
-
\??\c:\tbntnn.exec:\tbntnn.exe106⤵PID:2244
-
\??\c:\1ddvj.exec:\1ddvj.exe107⤵PID:3208
-
\??\c:\frrxlrr.exec:\frrxlrr.exe108⤵PID:4540
-
\??\c:\rffxrrr.exec:\rffxrrr.exe109⤵PID:2604
-
\??\c:\bnnnbn.exec:\bnnnbn.exe110⤵PID:1304
-
\??\c:\9jddv.exec:\9jddv.exe111⤵PID:3628
-
\??\c:\vdpjv.exec:\vdpjv.exe112⤵PID:804
-
\??\c:\3rfrfrl.exec:\3rfrfrl.exe113⤵PID:4360
-
\??\c:\nhnhbh.exec:\nhnhbh.exe114⤵PID:4840
-
\??\c:\dpppj.exec:\dpppj.exe115⤵PID:4504
-
\??\c:\jddpd.exec:\jddpd.exe116⤵PID:1996
-
\??\c:\1xrlrxl.exec:\1xrlrxl.exe117⤵PID:4860
-
\??\c:\btnhhb.exec:\btnhhb.exe118⤵PID:4992
-
\??\c:\dpvpj.exec:\dpvpj.exe119⤵PID:4652
-
\??\c:\jjjvv.exec:\jjjvv.exe120⤵PID:4508
-
\??\c:\flrflxr.exec:\flrflxr.exe121⤵PID:1400
-
\??\c:\3tbthh.exec:\3tbthh.exe122⤵PID:4480
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-