Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 01:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
93cd3cac6f6691061ac4e5a5515a68853c326498f1bcd404210bbbd81f89033a.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
93cd3cac6f6691061ac4e5a5515a68853c326498f1bcd404210bbbd81f89033a.exe
-
Size
454KB
-
MD5
09a2c626e2c1fd9159a71f10dd8abf04
-
SHA1
4748e5288a6a2798aadc1e3ea4a7f14e6124be50
-
SHA256
93cd3cac6f6691061ac4e5a5515a68853c326498f1bcd404210bbbd81f89033a
-
SHA512
60e4a0733f434e65f8b24584a3a8d72e3cd0002113c3f786764a18b874b1f3d036402d1731cff98095cf896be5d382e232aba07f9c5706666b23c382a69de7b2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbel:q7Tc2NYHUrAwfMp3CDl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1932-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2516-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1084-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3420-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/612-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1080-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4120-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/804-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2340-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4196-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1216-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2852-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1496-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3400-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1324-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2376-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4192-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-549-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-563-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2812-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-742-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-884-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/428-1270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-1484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3672 hbhbtn.exe 4416 lxxrlff.exe 3420 9nnhbb.exe 2516 jpddv.exe 1084 pjpdv.exe 5024 rllfrrf.exe 612 5hnbtt.exe 228 nhthnh.exe 5064 1nttnn.exe 1884 vjdvp.exe 4680 bnthbt.exe 1616 lxxrlfx.exe 2312 dppjp.exe 2308 nnhbtn.exe 1988 llfxrlf.exe 4120 jjjvp.exe 3444 nbhtnh.exe 1080 dvpjd.exe 4656 frlfxxr.exe 2596 lrrlrlf.exe 3504 rxrxxxr.exe 5000 htntnn.exe 1668 vdpvd.exe 4552 xrffffl.exe 2104 nbhbtt.exe 804 hbhbnh.exe 2520 vpvvv.exe 4292 ntbtbb.exe 4328 lxfxrll.exe 4112 tbnhnh.exe 3244 dddvp.exe 2340 lfllffl.exe 2004 9hnhhh.exe 1600 5jpdv.exe 2716 pjjdv.exe 2644 rllllff.exe 4196 htbttt.exe 1028 hhtnhh.exe 1820 vjppj.exe 3464 rrlffxx.exe 4676 jjpjd.exe 3324 vpppp.exe 1640 nbhbtt.exe 1504 pjpjj.exe 3308 xxxxxff.exe 1212 nhttbb.exe 2368 lrxrllf.exe 1216 thbhtn.exe 2852 ppvpj.exe 2488 hhhhhh.exe 4524 3djvp.exe 4468 nbnbbn.exe 392 3pjdd.exe 1036 frfxrrr.exe 768 hthbbb.exe 4416 7jpjd.exe 32 xrxrrrl.exe 3344 xxxxfxl.exe 3928 7btnnn.exe 1496 jpdvj.exe 5068 5dpjp.exe 4052 nbhtnt.exe 3400 9pvpp.exe 1512 5jpjd.exe -
resource yara_rule behavioral2/memory/1932-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2516-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1084-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3420-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/612-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4120-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/804-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2340-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4196-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1028-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1216-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2852-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2488-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3400-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1324-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4192-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1096-742-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1932 wrote to memory of 3672 1932 93cd3cac6f6691061ac4e5a5515a68853c326498f1bcd404210bbbd81f89033a.exe 82 PID 1932 wrote to memory of 3672 1932 93cd3cac6f6691061ac4e5a5515a68853c326498f1bcd404210bbbd81f89033a.exe 82 PID 1932 wrote to memory of 3672 1932 93cd3cac6f6691061ac4e5a5515a68853c326498f1bcd404210bbbd81f89033a.exe 82 PID 3672 wrote to memory of 4416 3672 hbhbtn.exe 83 PID 3672 wrote to memory of 4416 3672 hbhbtn.exe 83 PID 3672 wrote to memory of 4416 3672 hbhbtn.exe 83 PID 4416 wrote to memory of 3420 4416 lxxrlff.exe 84 PID 4416 wrote to memory of 3420 4416 lxxrlff.exe 84 PID 4416 wrote to memory of 3420 4416 lxxrlff.exe 84 PID 3420 wrote to memory of 2516 3420 9nnhbb.exe 85 PID 3420 wrote to memory of 2516 3420 9nnhbb.exe 85 PID 3420 wrote to memory of 2516 3420 9nnhbb.exe 85 PID 2516 wrote to memory of 1084 2516 jpddv.exe 86 PID 2516 wrote to memory of 1084 2516 jpddv.exe 86 PID 2516 wrote to memory of 1084 2516 jpddv.exe 86 PID 1084 wrote to memory of 5024 1084 pjpdv.exe 87 PID 1084 wrote to memory of 5024 1084 pjpdv.exe 87 PID 1084 wrote to memory of 5024 1084 pjpdv.exe 87 PID 5024 wrote to memory of 612 5024 rllfrrf.exe 88 PID 5024 wrote to memory of 612 5024 rllfrrf.exe 88 PID 5024 wrote to memory of 612 5024 rllfrrf.exe 88 PID 612 wrote to memory of 228 612 5hnbtt.exe 89 PID 612 wrote to memory of 228 612 5hnbtt.exe 89 PID 612 wrote to memory of 228 612 5hnbtt.exe 89 PID 228 wrote to memory of 5064 228 nhthnh.exe 90 PID 228 wrote to memory of 5064 228 nhthnh.exe 90 PID 228 wrote to memory of 5064 228 nhthnh.exe 90 PID 5064 wrote to memory of 1884 5064 1nttnn.exe 91 PID 5064 wrote to memory of 1884 5064 1nttnn.exe 91 PID 5064 wrote to memory of 1884 5064 1nttnn.exe 91 PID 1884 wrote to memory of 4680 1884 vjdvp.exe 92 PID 1884 wrote to memory of 4680 1884 vjdvp.exe 92 PID 1884 wrote to memory of 4680 1884 vjdvp.exe 92 PID 4680 wrote to memory of 1616 4680 bnthbt.exe 93 PID 4680 wrote to memory of 1616 4680 bnthbt.exe 93 PID 4680 wrote to memory of 1616 4680 bnthbt.exe 93 PID 1616 wrote to memory of 2312 1616 lxxrlfx.exe 94 PID 1616 wrote to memory of 2312 1616 lxxrlfx.exe 94 PID 1616 wrote to memory of 2312 1616 lxxrlfx.exe 94 PID 2312 wrote to memory of 2308 2312 dppjp.exe 95 PID 2312 wrote to memory of 2308 2312 dppjp.exe 95 PID 2312 wrote to memory of 2308 2312 dppjp.exe 95 PID 2308 wrote to memory of 1988 2308 nnhbtn.exe 96 PID 2308 wrote to memory of 1988 2308 nnhbtn.exe 96 PID 2308 wrote to memory of 1988 2308 nnhbtn.exe 96 PID 1988 wrote to memory of 4120 1988 llfxrlf.exe 97 PID 1988 wrote to memory of 4120 1988 llfxrlf.exe 97 PID 1988 wrote to memory of 4120 1988 llfxrlf.exe 97 PID 4120 wrote to memory of 3444 4120 jjjvp.exe 98 PID 4120 wrote to memory of 3444 4120 jjjvp.exe 98 PID 4120 wrote to memory of 3444 4120 jjjvp.exe 98 PID 3444 wrote to memory of 1080 3444 nbhtnh.exe 99 PID 3444 wrote to memory of 1080 3444 nbhtnh.exe 99 PID 3444 wrote to memory of 1080 3444 nbhtnh.exe 99 PID 1080 wrote to memory of 4656 1080 dvpjd.exe 100 PID 1080 wrote to memory of 4656 1080 dvpjd.exe 100 PID 1080 wrote to memory of 4656 1080 dvpjd.exe 100 PID 4656 wrote to memory of 2596 4656 frlfxxr.exe 101 PID 4656 wrote to memory of 2596 4656 frlfxxr.exe 101 PID 4656 wrote to memory of 2596 4656 frlfxxr.exe 101 PID 2596 wrote to memory of 3504 2596 lrrlrlf.exe 102 PID 2596 wrote to memory of 3504 2596 lrrlrlf.exe 102 PID 2596 wrote to memory of 3504 2596 lrrlrlf.exe 102 PID 3504 wrote to memory of 5000 3504 rxrxxxr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\93cd3cac6f6691061ac4e5a5515a68853c326498f1bcd404210bbbd81f89033a.exe"C:\Users\Admin\AppData\Local\Temp\93cd3cac6f6691061ac4e5a5515a68853c326498f1bcd404210bbbd81f89033a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\hbhbtn.exec:\hbhbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\lxxrlff.exec:\lxxrlff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\9nnhbb.exec:\9nnhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\jpddv.exec:\jpddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\pjpdv.exec:\pjpdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\rllfrrf.exec:\rllfrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\5hnbtt.exec:\5hnbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
\??\c:\nhthnh.exec:\nhthnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\1nttnn.exec:\1nttnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\vjdvp.exec:\vjdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\bnthbt.exec:\bnthbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\dppjp.exec:\dppjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\nnhbtn.exec:\nnhbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\llfxrlf.exec:\llfxrlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\jjjvp.exec:\jjjvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\nbhtnh.exec:\nbhtnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\dvpjd.exec:\dvpjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\frlfxxr.exec:\frlfxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\lrrlrlf.exec:\lrrlrlf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\rxrxxxr.exec:\rxrxxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\htntnn.exec:\htntnn.exe23⤵
- Executes dropped EXE
PID:5000 -
\??\c:\vdpvd.exec:\vdpvd.exe24⤵
- Executes dropped EXE
PID:1668 -
\??\c:\xrffffl.exec:\xrffffl.exe25⤵
- Executes dropped EXE
PID:4552 -
\??\c:\nbhbtt.exec:\nbhbtt.exe26⤵
- Executes dropped EXE
PID:2104 -
\??\c:\hbhbnh.exec:\hbhbnh.exe27⤵
- Executes dropped EXE
PID:804 -
\??\c:\vpvvv.exec:\vpvvv.exe28⤵
- Executes dropped EXE
PID:2520 -
\??\c:\ntbtbb.exec:\ntbtbb.exe29⤵
- Executes dropped EXE
PID:4292 -
\??\c:\lxfxrll.exec:\lxfxrll.exe30⤵
- Executes dropped EXE
PID:4328 -
\??\c:\tbnhnh.exec:\tbnhnh.exe31⤵
- Executes dropped EXE
PID:4112 -
\??\c:\dddvp.exec:\dddvp.exe32⤵
- Executes dropped EXE
PID:3244 -
\??\c:\lfllffl.exec:\lfllffl.exe33⤵
- Executes dropped EXE
PID:2340 -
\??\c:\9hnhhh.exec:\9hnhhh.exe34⤵
- Executes dropped EXE
PID:2004 -
\??\c:\5jpdv.exec:\5jpdv.exe35⤵
- Executes dropped EXE
PID:1600 -
\??\c:\pjjdv.exec:\pjjdv.exe36⤵
- Executes dropped EXE
PID:2716 -
\??\c:\rllllff.exec:\rllllff.exe37⤵
- Executes dropped EXE
PID:2644 -
\??\c:\htbttt.exec:\htbttt.exe38⤵
- Executes dropped EXE
PID:4196 -
\??\c:\hhtnhh.exec:\hhtnhh.exe39⤵
- Executes dropped EXE
PID:1028 -
\??\c:\vjppj.exec:\vjppj.exe40⤵
- Executes dropped EXE
PID:1820 -
\??\c:\rrlffxx.exec:\rrlffxx.exe41⤵
- Executes dropped EXE
PID:3464 -
\??\c:\jjpjd.exec:\jjpjd.exe42⤵
- Executes dropped EXE
PID:4676 -
\??\c:\vpppp.exec:\vpppp.exe43⤵
- Executes dropped EXE
PID:3324 -
\??\c:\nbhbtt.exec:\nbhbtt.exe44⤵
- Executes dropped EXE
PID:1640 -
\??\c:\pjpjj.exec:\pjpjj.exe45⤵
- Executes dropped EXE
PID:1504 -
\??\c:\xxxxxff.exec:\xxxxxff.exe46⤵
- Executes dropped EXE
PID:3308 -
\??\c:\nhttbb.exec:\nhttbb.exe47⤵
- Executes dropped EXE
PID:1212 -
\??\c:\lrxrllf.exec:\lrxrllf.exe48⤵
- Executes dropped EXE
PID:2368 -
\??\c:\thbhtn.exec:\thbhtn.exe49⤵
- Executes dropped EXE
PID:1216 -
\??\c:\ppvpj.exec:\ppvpj.exe50⤵
- Executes dropped EXE
PID:2852 -
\??\c:\hhhhhh.exec:\hhhhhh.exe51⤵
- Executes dropped EXE
PID:2488 -
\??\c:\3djvp.exec:\3djvp.exe52⤵
- Executes dropped EXE
PID:4524 -
\??\c:\nbnbbn.exec:\nbnbbn.exe53⤵
- Executes dropped EXE
PID:4468 -
\??\c:\3pjdd.exec:\3pjdd.exe54⤵
- Executes dropped EXE
PID:392 -
\??\c:\frfxrrr.exec:\frfxrrr.exe55⤵
- Executes dropped EXE
PID:1036 -
\??\c:\hthbbb.exec:\hthbbb.exe56⤵
- Executes dropped EXE
PID:768 -
\??\c:\7jpjd.exec:\7jpjd.exe57⤵
- Executes dropped EXE
PID:4416 -
\??\c:\xrxrrrl.exec:\xrxrrrl.exe58⤵
- Executes dropped EXE
PID:32 -
\??\c:\xxxxfxl.exec:\xxxxfxl.exe59⤵
- Executes dropped EXE
PID:3344 -
\??\c:\7btnnn.exec:\7btnnn.exe60⤵
- Executes dropped EXE
PID:3928 -
\??\c:\jpdvj.exec:\jpdvj.exe61⤵
- Executes dropped EXE
PID:1496 -
\??\c:\5dpjp.exec:\5dpjp.exe62⤵
- Executes dropped EXE
PID:5068 -
\??\c:\nbhtnt.exec:\nbhtnt.exe63⤵
- Executes dropped EXE
PID:4052 -
\??\c:\9pvpp.exec:\9pvpp.exe64⤵
- Executes dropped EXE
PID:3400 -
\??\c:\5jpjd.exec:\5jpjd.exe65⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rlfxffl.exec:\rlfxffl.exe66⤵PID:228
-
\??\c:\hhnhbt.exec:\hhnhbt.exe67⤵
- System Location Discovery: System Language Discovery
PID:4856 -
\??\c:\hbhbhh.exec:\hbhbhh.exe68⤵PID:4888
-
\??\c:\vjdvp.exec:\vjdvp.exe69⤵PID:2384
-
\??\c:\rrrxrfr.exec:\rrrxrfr.exe70⤵PID:3476
-
\??\c:\hntnhb.exec:\hntnhb.exe71⤵PID:4680
-
\??\c:\tbhhbb.exec:\tbhhbb.exe72⤵PID:3004
-
\??\c:\pdjdd.exec:\pdjdd.exe73⤵PID:3144
-
\??\c:\rfrfxxr.exec:\rfrfxxr.exe74⤵PID:2312
-
\??\c:\bthntt.exec:\bthntt.exe75⤵PID:536
-
\??\c:\5vdvp.exec:\5vdvp.exe76⤵PID:1548
-
\??\c:\5fxrffx.exec:\5fxrffx.exe77⤵PID:1988
-
\??\c:\hbtnhh.exec:\hbtnhh.exe78⤵PID:3984
-
\??\c:\pvvvp.exec:\pvvvp.exe79⤵PID:3444
-
\??\c:\rflllll.exec:\rflllll.exe80⤵PID:3472
-
\??\c:\bhnhbb.exec:\bhnhbb.exe81⤵PID:2808
-
\??\c:\jppjd.exec:\jppjd.exe82⤵PID:2800
-
\??\c:\lfllffx.exec:\lfllffx.exe83⤵PID:1924
-
\??\c:\xfffrll.exec:\xfffrll.exe84⤵PID:2248
-
\??\c:\tntnnn.exec:\tntnnn.exe85⤵PID:1528
-
\??\c:\pppvp.exec:\pppvp.exe86⤵PID:1612
-
\??\c:\xlrlfff.exec:\xlrlfff.exe87⤵PID:2460
-
\??\c:\rxffxfx.exec:\rxffxfx.exe88⤵PID:1668
-
\??\c:\nnnhnt.exec:\nnnhnt.exe89⤵PID:3556
-
\??\c:\jdjdv.exec:\jdjdv.exe90⤵PID:4064
-
\??\c:\9xxlfll.exec:\9xxlfll.exe91⤵PID:4536
-
\??\c:\xxffxxr.exec:\xxffxxr.exe92⤵PID:3248
-
\??\c:\3vpjd.exec:\3vpjd.exe93⤵PID:1948
-
\??\c:\vpppj.exec:\vpppj.exe94⤵PID:5056
-
\??\c:\xlxrllf.exec:\xlxrllf.exe95⤵PID:2660
-
\??\c:\bhnnbt.exec:\bhnnbt.exe96⤵PID:3056
-
\??\c:\pvpjd.exec:\pvpjd.exe97⤵PID:4108
-
\??\c:\xfrxlff.exec:\xfrxlff.exe98⤵PID:2340
-
\??\c:\1thtnh.exec:\1thtnh.exe99⤵PID:4940
-
\??\c:\jddvp.exec:\jddvp.exe100⤵PID:1324
-
\??\c:\7lfxrrl.exec:\7lfxrrl.exe101⤵PID:3704
-
\??\c:\nbbbtt.exec:\nbbbtt.exe102⤵PID:2056
-
\??\c:\vddvp.exec:\vddvp.exe103⤵PID:2716
-
\??\c:\lfxrrrr.exec:\lfxrrrr.exe104⤵PID:512
-
\??\c:\1nnhhh.exec:\1nnhhh.exe105⤵PID:3744
-
\??\c:\vddvj.exec:\vddvj.exe106⤵PID:1480
-
\??\c:\frfrllf.exec:\frfrllf.exe107⤵PID:5060
-
\??\c:\rxxlxll.exec:\rxxlxll.exe108⤵PID:3604
-
\??\c:\thhbtt.exec:\thhbtt.exe109⤵PID:3776
-
\??\c:\dpvpj.exec:\dpvpj.exe110⤵PID:2140
-
\??\c:\llxfrfr.exec:\llxfrfr.exe111⤵PID:4956
-
\??\c:\5xxxrrr.exec:\5xxxrrr.exe112⤵PID:1712
-
\??\c:\1bhbtn.exec:\1bhbtn.exe113⤵PID:4608
-
\??\c:\dpdjd.exec:\dpdjd.exe114⤵PID:2388
-
\??\c:\flfrllr.exec:\flfrllr.exe115⤵PID:388
-
\??\c:\tnnhbt.exec:\tnnhbt.exe116⤵PID:3492
-
\??\c:\nthbtt.exec:\nthbtt.exe117⤵PID:4256
-
\??\c:\1vdvd.exec:\1vdvd.exe118⤵PID:3632
-
\??\c:\lllfxxr.exec:\lllfxxr.exe119⤵PID:2376
-
\??\c:\tntnbt.exec:\tntnbt.exe120⤵PID:4460
-
\??\c:\pjpjd.exec:\pjpjd.exe121⤵PID:756
-
\??\c:\lflfxrl.exec:\lflfxrl.exe122⤵PID:392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-