Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2024, 21:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2c44b92c03b518f92f617cfdc8e6e97afc667cf1fb76b9ec5e6d5c43dd491d1e.exe
Resource
win7-20240708-en
7 signatures
150 seconds
General
-
Target
2c44b92c03b518f92f617cfdc8e6e97afc667cf1fb76b9ec5e6d5c43dd491d1e.exe
-
Size
456KB
-
MD5
3c5c533919eef08d52a482eb76643382
-
SHA1
133a12794d4d06b5fb3dbb55ea9a2d3234b314ac
-
SHA256
2c44b92c03b518f92f617cfdc8e6e97afc667cf1fb76b9ec5e6d5c43dd491d1e
-
SHA512
4ff4cf6a9f5e262d730c8c43e8f50d5d5bf799b8960a3e8b06a447edc282e06e17aabf11c8e73fc4a87099c1b1e18cdfb1dae1a10c4a6f086aca2a0a793d48d3
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRg:q7Tc2NYHUrAwfMp3CDRg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1464-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2044-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3768-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1404-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4252-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4164-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1080-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/664-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1404-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1848-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1768-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1300-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3360-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3120-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1676-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-789-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-796-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2888 bbhbtn.exe 4448 5nbttb.exe 232 1vpjv.exe 2728 7vvpj.exe 2044 dppdv.exe 4320 hhhthh.exe 1192 xrxrrll.exe 3768 ttbbbb.exe 3464 tbtnhn.exe 1404 pppjd.exe 3692 nhhbtt.exe 1408 rrflffx.exe 2744 nnhthb.exe 4252 flxrrlf.exe 3240 jvddv.exe 3744 frrlfrl.exe 2496 btbtnh.exe 4044 xfffffr.exe 4164 1tnhtt.exe 2876 1vpjd.exe 3436 9rfxrrx.exe 984 hbhbbt.exe 3968 lllllll.exe 2884 vjdvv.exe 1452 lflfxrl.exe 1356 xrxrlfx.exe 3596 xfrxlxl.exe 5008 jjdvp.exe 2240 1rrlfxr.exe 3100 dvjdv.exe 768 xlllffx.exe 4152 xxlflrl.exe 2628 vpvvj.exe 4680 lrxxxxx.exe 4844 bbbbtt.exe 1780 thtttb.exe 1124 pjvvv.exe 3468 9xxxfll.exe 4468 5nttth.exe 2220 jpjjj.exe 3620 xxfflrr.exe 4912 hhbbtb.exe 2192 dpvjv.exe 1724 1lxxlrr.exe 1080 llxfflf.exe 4572 3hhbbh.exe 2708 djjvv.exe 664 5xllrlr.exe 968 rfllffx.exe 4412 3bbbbb.exe 3484 pdjjj.exe 4456 9xlfxxr.exe 4448 htnnhn.exe 4292 ddjpp.exe 2916 ffrrxxf.exe 4736 lrxrrrx.exe 1524 tnnnnn.exe 1720 1jvvp.exe 2952 lfrrxfr.exe 1104 hnhbbt.exe 652 vdvjv.exe 3360 3xrfxrl.exe 4424 fflfxrl.exe 1404 ttttnh.exe -
resource yara_rule behavioral2/memory/1464-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2044-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1192-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3768-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1192-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4252-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1124-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/664-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1848-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1768-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1300-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3360-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1808-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3120-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1676-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-617-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1464 wrote to memory of 2888 1464 2c44b92c03b518f92f617cfdc8e6e97afc667cf1fb76b9ec5e6d5c43dd491d1e.exe 83 PID 1464 wrote to memory of 2888 1464 2c44b92c03b518f92f617cfdc8e6e97afc667cf1fb76b9ec5e6d5c43dd491d1e.exe 83 PID 1464 wrote to memory of 2888 1464 2c44b92c03b518f92f617cfdc8e6e97afc667cf1fb76b9ec5e6d5c43dd491d1e.exe 83 PID 2888 wrote to memory of 4448 2888 bbhbtn.exe 84 PID 2888 wrote to memory of 4448 2888 bbhbtn.exe 84 PID 2888 wrote to memory of 4448 2888 bbhbtn.exe 84 PID 4448 wrote to memory of 232 4448 5nbttb.exe 85 PID 4448 wrote to memory of 232 4448 5nbttb.exe 85 PID 4448 wrote to memory of 232 4448 5nbttb.exe 85 PID 232 wrote to memory of 2728 232 1vpjv.exe 86 PID 232 wrote to memory of 2728 232 1vpjv.exe 86 PID 232 wrote to memory of 2728 232 1vpjv.exe 86 PID 2728 wrote to memory of 2044 2728 7vvpj.exe 87 PID 2728 wrote to memory of 2044 2728 7vvpj.exe 87 PID 2728 wrote to memory of 2044 2728 7vvpj.exe 87 PID 2044 wrote to memory of 4320 2044 dppdv.exe 88 PID 2044 wrote to memory of 4320 2044 dppdv.exe 88 PID 2044 wrote to memory of 4320 2044 dppdv.exe 88 PID 4320 wrote to memory of 1192 4320 hhhthh.exe 89 PID 4320 wrote to memory of 1192 4320 hhhthh.exe 89 PID 4320 wrote to memory of 1192 4320 hhhthh.exe 89 PID 1192 wrote to memory of 3768 1192 xrxrrll.exe 90 PID 1192 wrote to memory of 3768 1192 xrxrrll.exe 90 PID 1192 wrote to memory of 3768 1192 xrxrrll.exe 90 PID 3768 wrote to memory of 3464 3768 ttbbbb.exe 91 PID 3768 wrote to memory of 3464 3768 ttbbbb.exe 91 PID 3768 wrote to memory of 3464 3768 ttbbbb.exe 91 PID 3464 wrote to memory of 1404 3464 tbtnhn.exe 92 PID 3464 wrote to memory of 1404 3464 tbtnhn.exe 92 PID 3464 wrote to memory of 1404 3464 tbtnhn.exe 92 PID 1404 wrote to memory of 3692 1404 pppjd.exe 93 PID 1404 wrote to memory of 3692 1404 pppjd.exe 93 PID 1404 wrote to memory of 3692 1404 pppjd.exe 93 PID 3692 wrote to memory of 1408 3692 nhhbtt.exe 94 PID 3692 wrote to memory of 1408 3692 nhhbtt.exe 94 PID 3692 wrote to memory of 1408 3692 nhhbtt.exe 94 PID 1408 wrote to memory of 2744 1408 rrflffx.exe 95 PID 1408 wrote to memory of 2744 1408 rrflffx.exe 95 PID 1408 wrote to memory of 2744 1408 rrflffx.exe 95 PID 2744 wrote to memory of 4252 2744 nnhthb.exe 96 PID 2744 wrote to memory of 4252 2744 nnhthb.exe 96 PID 2744 wrote to memory of 4252 2744 nnhthb.exe 96 PID 4252 wrote to memory of 3240 4252 flxrrlf.exe 97 PID 4252 wrote to memory of 3240 4252 flxrrlf.exe 97 PID 4252 wrote to memory of 3240 4252 flxrrlf.exe 97 PID 3240 wrote to memory of 3744 3240 jvddv.exe 98 PID 3240 wrote to memory of 3744 3240 jvddv.exe 98 PID 3240 wrote to memory of 3744 3240 jvddv.exe 98 PID 3744 wrote to memory of 2496 3744 frrlfrl.exe 99 PID 3744 wrote to memory of 2496 3744 frrlfrl.exe 99 PID 3744 wrote to memory of 2496 3744 frrlfrl.exe 99 PID 2496 wrote to memory of 4044 2496 btbtnh.exe 100 PID 2496 wrote to memory of 4044 2496 btbtnh.exe 100 PID 2496 wrote to memory of 4044 2496 btbtnh.exe 100 PID 4044 wrote to memory of 4164 4044 xfffffr.exe 101 PID 4044 wrote to memory of 4164 4044 xfffffr.exe 101 PID 4044 wrote to memory of 4164 4044 xfffffr.exe 101 PID 4164 wrote to memory of 2876 4164 1tnhtt.exe 102 PID 4164 wrote to memory of 2876 4164 1tnhtt.exe 102 PID 4164 wrote to memory of 2876 4164 1tnhtt.exe 102 PID 2876 wrote to memory of 3436 2876 1vpjd.exe 103 PID 2876 wrote to memory of 3436 2876 1vpjd.exe 103 PID 2876 wrote to memory of 3436 2876 1vpjd.exe 103 PID 3436 wrote to memory of 984 3436 9rfxrrx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c44b92c03b518f92f617cfdc8e6e97afc667cf1fb76b9ec5e6d5c43dd491d1e.exe"C:\Users\Admin\AppData\Local\Temp\2c44b92c03b518f92f617cfdc8e6e97afc667cf1fb76b9ec5e6d5c43dd491d1e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\bbhbtn.exec:\bbhbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\5nbttb.exec:\5nbttb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\1vpjv.exec:\1vpjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\7vvpj.exec:\7vvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\dppdv.exec:\dppdv.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\hhhthh.exec:\hhhthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\xrxrrll.exec:\xrxrrll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\ttbbbb.exec:\ttbbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\tbtnhn.exec:\tbtnhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\pppjd.exec:\pppjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\nhhbtt.exec:\nhhbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\rrflffx.exec:\rrflffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\nnhthb.exec:\nnhthb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\flxrrlf.exec:\flxrrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\jvddv.exec:\jvddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\frrlfrl.exec:\frrlfrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\btbtnh.exec:\btbtnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\xfffffr.exec:\xfffffr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\1tnhtt.exec:\1tnhtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\1vpjd.exec:\1vpjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\9rfxrrx.exec:\9rfxrrx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\hbhbbt.exec:\hbhbbt.exe23⤵
- Executes dropped EXE
PID:984 -
\??\c:\lllllll.exec:\lllllll.exe24⤵
- Executes dropped EXE
PID:3968 -
\??\c:\vjdvv.exec:\vjdvv.exe25⤵
- Executes dropped EXE
PID:2884 -
\??\c:\lflfxrl.exec:\lflfxrl.exe26⤵
- Executes dropped EXE
PID:1452 -
\??\c:\xrxrlfx.exec:\xrxrlfx.exe27⤵
- Executes dropped EXE
PID:1356 -
\??\c:\xfrxlxl.exec:\xfrxlxl.exe28⤵
- Executes dropped EXE
PID:3596 -
\??\c:\jjdvp.exec:\jjdvp.exe29⤵
- Executes dropped EXE
PID:5008 -
\??\c:\1rrlfxr.exec:\1rrlfxr.exe30⤵
- Executes dropped EXE
PID:2240 -
\??\c:\dvjdv.exec:\dvjdv.exe31⤵
- Executes dropped EXE
PID:3100 -
\??\c:\xlllffx.exec:\xlllffx.exe32⤵
- Executes dropped EXE
PID:768 -
\??\c:\xxlflrl.exec:\xxlflrl.exe33⤵
- Executes dropped EXE
PID:4152 -
\??\c:\vpvvj.exec:\vpvvj.exe34⤵
- Executes dropped EXE
PID:2628 -
\??\c:\lrxxxxx.exec:\lrxxxxx.exe35⤵
- Executes dropped EXE
PID:4680 -
\??\c:\bbbbtt.exec:\bbbbtt.exe36⤵
- Executes dropped EXE
PID:4844 -
\??\c:\thtttb.exec:\thtttb.exe37⤵
- Executes dropped EXE
PID:1780 -
\??\c:\pjvvv.exec:\pjvvv.exe38⤵
- Executes dropped EXE
PID:1124 -
\??\c:\9xxxfll.exec:\9xxxfll.exe39⤵
- Executes dropped EXE
PID:3468 -
\??\c:\5nttth.exec:\5nttth.exe40⤵
- Executes dropped EXE
PID:4468 -
\??\c:\jpjjj.exec:\jpjjj.exe41⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xxfflrr.exec:\xxfflrr.exe42⤵
- Executes dropped EXE
PID:3620 -
\??\c:\hhbbtb.exec:\hhbbtb.exe43⤵
- Executes dropped EXE
PID:4912 -
\??\c:\dpvjv.exec:\dpvjv.exe44⤵
- Executes dropped EXE
PID:2192 -
\??\c:\1lxxlrr.exec:\1lxxlrr.exe45⤵
- Executes dropped EXE
PID:1724 -
\??\c:\llxfflf.exec:\llxfflf.exe46⤵
- Executes dropped EXE
PID:1080 -
\??\c:\3hhbbh.exec:\3hhbbh.exe47⤵
- Executes dropped EXE
PID:4572 -
\??\c:\djjvv.exec:\djjvv.exe48⤵
- Executes dropped EXE
PID:2708 -
\??\c:\5xllrlr.exec:\5xllrlr.exe49⤵
- Executes dropped EXE
PID:664 -
\??\c:\rfllffx.exec:\rfllffx.exe50⤵
- Executes dropped EXE
PID:968 -
\??\c:\3bbbbb.exec:\3bbbbb.exe51⤵
- Executes dropped EXE
PID:4412 -
\??\c:\pdjjj.exec:\pdjjj.exe52⤵
- Executes dropped EXE
PID:3484 -
\??\c:\9xlfxxr.exec:\9xlfxxr.exe53⤵
- Executes dropped EXE
PID:4456 -
\??\c:\htnnhn.exec:\htnnhn.exe54⤵
- Executes dropped EXE
PID:4448 -
\??\c:\ddjpp.exec:\ddjpp.exe55⤵
- Executes dropped EXE
PID:4292 -
\??\c:\ffrrxxf.exec:\ffrrxxf.exe56⤵
- Executes dropped EXE
PID:2916 -
\??\c:\lrxrrrx.exec:\lrxrrrx.exe57⤵
- Executes dropped EXE
PID:4736 -
\??\c:\tnnnnn.exec:\tnnnnn.exe58⤵
- Executes dropped EXE
PID:1524 -
\??\c:\1jvvp.exec:\1jvvp.exe59⤵
- Executes dropped EXE
PID:1720 -
\??\c:\lfrrxfr.exec:\lfrrxfr.exe60⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hnhbbt.exec:\hnhbbt.exe61⤵
- Executes dropped EXE
PID:1104 -
\??\c:\vdvjv.exec:\vdvjv.exe62⤵
- Executes dropped EXE
PID:652 -
\??\c:\3xrfxrl.exec:\3xrfxrl.exe63⤵
- Executes dropped EXE
PID:3360 -
\??\c:\fflfxrl.exec:\fflfxrl.exe64⤵
- Executes dropped EXE
PID:4424 -
\??\c:\ttttnh.exec:\ttttnh.exe65⤵
- Executes dropped EXE
PID:1404 -
\??\c:\5jpjd.exec:\5jpjd.exe66⤵PID:2588
-
\??\c:\rlrflfl.exec:\rlrflfl.exe67⤵PID:2832
-
\??\c:\nnnhbb.exec:\nnnhbb.exe68⤵PID:1848
-
\??\c:\bntthn.exec:\bntthn.exe69⤵PID:2224
-
\??\c:\rrlfffl.exec:\rrlfffl.exe70⤵PID:1676
-
\??\c:\flfxffr.exec:\flfxffr.exe71⤵
- System Location Discovery: System Language Discovery
PID:3672 -
\??\c:\btbbnt.exec:\btbbnt.exe72⤵PID:912
-
\??\c:\vvvdd.exec:\vvvdd.exe73⤵PID:1636
-
\??\c:\7lrlllf.exec:\7lrlllf.exe74⤵PID:4496
-
\??\c:\frrrlrr.exec:\frrrlrr.exe75⤵PID:2096
-
\??\c:\bnhtnn.exec:\bnhtnn.exe76⤵PID:3944
-
\??\c:\pppjj.exec:\pppjj.exe77⤵PID:1596
-
\??\c:\xxlfxrr.exec:\xxlfxrr.exe78⤵PID:1768
-
\??\c:\htbbnt.exec:\htbbnt.exe79⤵PID:3268
-
\??\c:\7vpjd.exec:\7vpjd.exe80⤵PID:1020
-
\??\c:\1lfffff.exec:\1lfffff.exe81⤵PID:1692
-
\??\c:\rlxxxxr.exec:\rlxxxxr.exe82⤵PID:1600
-
\??\c:\ntnnhh.exec:\ntnnhh.exe83⤵PID:3968
-
\??\c:\1vddd.exec:\1vddd.exe84⤵PID:2884
-
\??\c:\lflfxxf.exec:\lflfxxf.exe85⤵PID:712
-
\??\c:\rxfxfxf.exec:\rxfxfxf.exe86⤵PID:1972
-
\??\c:\nttnbh.exec:\nttnbh.exe87⤵PID:2804
-
\??\c:\vjjdp.exec:\vjjdp.exe88⤵PID:2264
-
\??\c:\5llxlff.exec:\5llxlff.exe89⤵PID:4744
-
\??\c:\tnnnnn.exec:\tnnnnn.exe90⤵PID:5008
-
\??\c:\ntbttt.exec:\ntbttt.exe91⤵PID:2144
-
\??\c:\jppjd.exec:\jppjd.exe92⤵PID:4832
-
\??\c:\3rrllrr.exec:\3rrllrr.exe93⤵PID:1300
-
\??\c:\3thnnt.exec:\3thnnt.exe94⤵PID:1200
-
\??\c:\bhtbnb.exec:\bhtbnb.exe95⤵PID:3508
-
\??\c:\3jjdv.exec:\3jjdv.exe96⤵PID:468
-
\??\c:\flfxrlf.exec:\flfxrlf.exe97⤵PID:1684
-
\??\c:\9tntnt.exec:\9tntnt.exe98⤵PID:728
-
\??\c:\pdjjj.exec:\pdjjj.exe99⤵PID:640
-
\??\c:\jpddv.exec:\jpddv.exe100⤵PID:3880
-
\??\c:\rxrxflr.exec:\rxrxflr.exe101⤵PID:400
-
\??\c:\hhtnhh.exec:\hhtnhh.exe102⤵PID:3472
-
\??\c:\jpjjp.exec:\jpjjp.exe103⤵PID:1572
-
\??\c:\7jjdv.exec:\7jjdv.exe104⤵PID:2140
-
\??\c:\frrrrrr.exec:\frrrrrr.exe105⤵PID:1952
-
\??\c:\bbtnbb.exec:\bbtnbb.exe106⤵PID:996
-
\??\c:\9ddjd.exec:\9ddjd.exe107⤵PID:3896
-
\??\c:\jpvpj.exec:\jpvpj.exe108⤵PID:628
-
\??\c:\ttnnbb.exec:\ttnnbb.exe109⤵PID:2056
-
\??\c:\tnnhtn.exec:\tnnhtn.exe110⤵PID:4572
-
\??\c:\7pjvp.exec:\7pjvp.exe111⤵PID:2708
-
\??\c:\lfrlffx.exec:\lfrlffx.exe112⤵PID:4340
-
\??\c:\nnhhhh.exec:\nnhhhh.exe113⤵PID:3928
-
\??\c:\pjjdp.exec:\pjjdp.exe114⤵PID:2924
-
\??\c:\llrrlfl.exec:\llrrlfl.exe115⤵PID:4880
-
\??\c:\ttbhbt.exec:\ttbhbt.exe116⤵PID:4560
-
\??\c:\ttnntt.exec:\ttnntt.exe117⤵PID:4456
-
\??\c:\1jvvp.exec:\1jvvp.exe118⤵PID:5112
-
\??\c:\7lllffx.exec:\7lllffx.exe119⤵PID:3888
-
\??\c:\ttnnbn.exec:\ttnnbn.exe120⤵PID:2992
-
\??\c:\ntbbtb.exec:\ntbbtb.exe121⤵PID:184
-
\??\c:\vdddv.exec:\vdddv.exe122⤵PID:3528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-