Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 04:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d565fdeee6b61ea738021ee53e7f0a56d5d26f953eb9dab6ce252b0e96ca3645.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
d565fdeee6b61ea738021ee53e7f0a56d5d26f953eb9dab6ce252b0e96ca3645.exe
-
Size
454KB
-
MD5
5821692ae6abb3232de000abefa33e81
-
SHA1
d02bd8b27c2124d2344211cc4e5e934053f38908
-
SHA256
d565fdeee6b61ea738021ee53e7f0a56d5d26f953eb9dab6ce252b0e96ca3645
-
SHA512
1c9f3bf9a7fa74a71bec245b598de6bd562414026c1b95cc57089e671f0c0dd821e8269e28c42fcfe2d9988a796ec9b87c47bd5c9d9b6d96e8f42d08f650e51d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeX:q7Tc2NYHUrAwfMp3CDX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2372-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1256-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1732-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/804-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2772-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4708-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3728-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1628-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2680-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1320-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1052-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3860-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1572-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1836-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3108-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-699-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3884-773-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-804-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-892-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-1062-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1412-1084-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-1169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-1521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1240-1769-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3464 thhbnh.exe 4836 pjvpd.exe 2088 lllrflf.exe 4416 bhnbtb.exe 2168 7vpjj.exe 4648 nhthbb.exe 1040 pjjdd.exe 3188 nntbtb.exe 2060 1tbtth.exe 1284 djdvp.exe 3952 fxllfrr.exe 1256 lrllxxl.exe 804 tthnth.exe 1732 vppjj.exe 2772 jdddj.exe 2500 bhbbhh.exe 2328 pdpjv.exe 3672 fxxrlfx.exe 2296 ddvvp.exe 3896 xrxlfxr.exe 5088 xxxxrrr.exe 1400 tnbthh.exe 2280 bhnhhh.exe 3772 7ddvp.exe 4580 bhnhtt.exe 2000 xxxrlfx.exe 4280 5lxrlrf.exe 4708 rlxxxrx.exe 3196 7btnbn.exe 3088 9llfrrl.exe 1096 9vpjd.exe 4772 ntnnth.exe 4076 ffrlxxl.exe 1608 bhhbhb.exe 3980 jjjdv.exe 2408 frxrrrl.exe 3768 5hthtb.exe 3152 lrlfxxr.exe 3728 lxfxrrl.exe 3616 jddpp.exe 1628 tntttt.exe 1168 rxrrrrf.exe 3620 hhhhbb.exe 2576 vjdvd.exe 2972 fffxxxx.exe 2680 bhhbhh.exe 1872 dppjd.exe 332 ffxrffx.exe 3924 9hhbth.exe 4268 jvdpj.exe 3912 jppjp.exe 4840 xrrfxrr.exe 1320 htnhtt.exe 3528 dvdpd.exe 2928 9pjdd.exe 3540 7lrfxxr.exe 4928 bnhbtt.exe 3452 vppjd.exe 3396 vjdjd.exe 2024 9rlfrxr.exe 3596 nnnhbb.exe 3488 pdjdd.exe 944 rrrfxxl.exe 3092 ttnhbb.exe -
resource yara_rule behavioral2/memory/2372-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1256-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1732-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/804-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2772-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2328-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4708-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1096-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3768-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3728-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1628-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2680-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1320-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1052-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3860-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1572-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1836-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3108-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3884-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-804-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2372 wrote to memory of 3464 2372 d565fdeee6b61ea738021ee53e7f0a56d5d26f953eb9dab6ce252b0e96ca3645.exe 83 PID 2372 wrote to memory of 3464 2372 d565fdeee6b61ea738021ee53e7f0a56d5d26f953eb9dab6ce252b0e96ca3645.exe 83 PID 2372 wrote to memory of 3464 2372 d565fdeee6b61ea738021ee53e7f0a56d5d26f953eb9dab6ce252b0e96ca3645.exe 83 PID 3464 wrote to memory of 4836 3464 thhbnh.exe 84 PID 3464 wrote to memory of 4836 3464 thhbnh.exe 84 PID 3464 wrote to memory of 4836 3464 thhbnh.exe 84 PID 4836 wrote to memory of 2088 4836 pjvpd.exe 85 PID 4836 wrote to memory of 2088 4836 pjvpd.exe 85 PID 4836 wrote to memory of 2088 4836 pjvpd.exe 85 PID 2088 wrote to memory of 4416 2088 lllrflf.exe 86 PID 2088 wrote to memory of 4416 2088 lllrflf.exe 86 PID 2088 wrote to memory of 4416 2088 lllrflf.exe 86 PID 4416 wrote to memory of 2168 4416 bhnbtb.exe 87 PID 4416 wrote to memory of 2168 4416 bhnbtb.exe 87 PID 4416 wrote to memory of 2168 4416 bhnbtb.exe 87 PID 2168 wrote to memory of 4648 2168 7vpjj.exe 88 PID 2168 wrote to memory of 4648 2168 7vpjj.exe 88 PID 2168 wrote to memory of 4648 2168 7vpjj.exe 88 PID 4648 wrote to memory of 1040 4648 nhthbb.exe 89 PID 4648 wrote to memory of 1040 4648 nhthbb.exe 89 PID 4648 wrote to memory of 1040 4648 nhthbb.exe 89 PID 1040 wrote to memory of 3188 1040 pjjdd.exe 90 PID 1040 wrote to memory of 3188 1040 pjjdd.exe 90 PID 1040 wrote to memory of 3188 1040 pjjdd.exe 90 PID 3188 wrote to memory of 2060 3188 nntbtb.exe 91 PID 3188 wrote to memory of 2060 3188 nntbtb.exe 91 PID 3188 wrote to memory of 2060 3188 nntbtb.exe 91 PID 2060 wrote to memory of 1284 2060 1tbtth.exe 92 PID 2060 wrote to memory of 1284 2060 1tbtth.exe 92 PID 2060 wrote to memory of 1284 2060 1tbtth.exe 92 PID 1284 wrote to memory of 3952 1284 djdvp.exe 93 PID 1284 wrote to memory of 3952 1284 djdvp.exe 93 PID 1284 wrote to memory of 3952 1284 djdvp.exe 93 PID 3952 wrote to memory of 1256 3952 fxllfrr.exe 94 PID 3952 wrote to memory of 1256 3952 fxllfrr.exe 94 PID 3952 wrote to memory of 1256 3952 fxllfrr.exe 94 PID 1256 wrote to memory of 804 1256 lrllxxl.exe 95 PID 1256 wrote to memory of 804 1256 lrllxxl.exe 95 PID 1256 wrote to memory of 804 1256 lrllxxl.exe 95 PID 804 wrote to memory of 1732 804 tthnth.exe 96 PID 804 wrote to memory of 1732 804 tthnth.exe 96 PID 804 wrote to memory of 1732 804 tthnth.exe 96 PID 1732 wrote to memory of 2772 1732 vppjj.exe 97 PID 1732 wrote to memory of 2772 1732 vppjj.exe 97 PID 1732 wrote to memory of 2772 1732 vppjj.exe 97 PID 2772 wrote to memory of 2500 2772 jdddj.exe 98 PID 2772 wrote to memory of 2500 2772 jdddj.exe 98 PID 2772 wrote to memory of 2500 2772 jdddj.exe 98 PID 2500 wrote to memory of 2328 2500 bhbbhh.exe 99 PID 2500 wrote to memory of 2328 2500 bhbbhh.exe 99 PID 2500 wrote to memory of 2328 2500 bhbbhh.exe 99 PID 2328 wrote to memory of 3672 2328 pdpjv.exe 100 PID 2328 wrote to memory of 3672 2328 pdpjv.exe 100 PID 2328 wrote to memory of 3672 2328 pdpjv.exe 100 PID 3672 wrote to memory of 2296 3672 fxxrlfx.exe 101 PID 3672 wrote to memory of 2296 3672 fxxrlfx.exe 101 PID 3672 wrote to memory of 2296 3672 fxxrlfx.exe 101 PID 2296 wrote to memory of 3896 2296 ddvvp.exe 102 PID 2296 wrote to memory of 3896 2296 ddvvp.exe 102 PID 2296 wrote to memory of 3896 2296 ddvvp.exe 102 PID 3896 wrote to memory of 5088 3896 xrxlfxr.exe 103 PID 3896 wrote to memory of 5088 3896 xrxlfxr.exe 103 PID 3896 wrote to memory of 5088 3896 xrxlfxr.exe 103 PID 5088 wrote to memory of 1400 5088 xxxxrrr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d565fdeee6b61ea738021ee53e7f0a56d5d26f953eb9dab6ce252b0e96ca3645.exe"C:\Users\Admin\AppData\Local\Temp\d565fdeee6b61ea738021ee53e7f0a56d5d26f953eb9dab6ce252b0e96ca3645.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\thhbnh.exec:\thhbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\pjvpd.exec:\pjvpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\lllrflf.exec:\lllrflf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\bhnbtb.exec:\bhnbtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\7vpjj.exec:\7vpjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\nhthbb.exec:\nhthbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\pjjdd.exec:\pjjdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\nntbtb.exec:\nntbtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\1tbtth.exec:\1tbtth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\djdvp.exec:\djdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\fxllfrr.exec:\fxllfrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\lrllxxl.exec:\lrllxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\tthnth.exec:\tthnth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\vppjj.exec:\vppjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\jdddj.exec:\jdddj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\bhbbhh.exec:\bhbbhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\pdpjv.exec:\pdpjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\ddvvp.exec:\ddvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\xrxlfxr.exec:\xrxlfxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\xxxxrrr.exec:\xxxxrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\tnbthh.exec:\tnbthh.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1400 -
\??\c:\bhnhhh.exec:\bhnhhh.exe24⤵
- Executes dropped EXE
PID:2280 -
\??\c:\7ddvp.exec:\7ddvp.exe25⤵
- Executes dropped EXE
PID:3772 -
\??\c:\bhnhtt.exec:\bhnhtt.exe26⤵
- Executes dropped EXE
PID:4580 -
\??\c:\xxxrlfx.exec:\xxxrlfx.exe27⤵
- Executes dropped EXE
PID:2000 -
\??\c:\5lxrlrf.exec:\5lxrlrf.exe28⤵
- Executes dropped EXE
PID:4280 -
\??\c:\rlxxxrx.exec:\rlxxxrx.exe29⤵
- Executes dropped EXE
PID:4708 -
\??\c:\7btnbn.exec:\7btnbn.exe30⤵
- Executes dropped EXE
PID:3196 -
\??\c:\9llfrrl.exec:\9llfrrl.exe31⤵
- Executes dropped EXE
PID:3088 -
\??\c:\9vpjd.exec:\9vpjd.exe32⤵
- Executes dropped EXE
PID:1096 -
\??\c:\ntnnth.exec:\ntnnth.exe33⤵
- Executes dropped EXE
PID:4772 -
\??\c:\ffrlxxl.exec:\ffrlxxl.exe34⤵
- Executes dropped EXE
PID:4076 -
\??\c:\bhhbhb.exec:\bhhbhb.exe35⤵
- Executes dropped EXE
PID:1608 -
\??\c:\jjjdv.exec:\jjjdv.exe36⤵
- Executes dropped EXE
PID:3980 -
\??\c:\frxrrrl.exec:\frxrrrl.exe37⤵
- Executes dropped EXE
PID:2408 -
\??\c:\5hthtb.exec:\5hthtb.exe38⤵
- Executes dropped EXE
PID:3768 -
\??\c:\lrlfxxr.exec:\lrlfxxr.exe39⤵
- Executes dropped EXE
PID:3152 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe40⤵
- Executes dropped EXE
PID:3728 -
\??\c:\jddpp.exec:\jddpp.exe41⤵
- Executes dropped EXE
PID:3616 -
\??\c:\tntttt.exec:\tntttt.exe42⤵
- Executes dropped EXE
PID:1628 -
\??\c:\rxrrrrf.exec:\rxrrrrf.exe43⤵
- Executes dropped EXE
PID:1168 -
\??\c:\hhhhbb.exec:\hhhhbb.exe44⤵
- Executes dropped EXE
PID:3620 -
\??\c:\vjdvd.exec:\vjdvd.exe45⤵
- Executes dropped EXE
PID:2576 -
\??\c:\fffxxxx.exec:\fffxxxx.exe46⤵
- Executes dropped EXE
PID:2972 -
\??\c:\bhhbhh.exec:\bhhbhh.exe47⤵
- Executes dropped EXE
PID:2680 -
\??\c:\dppjd.exec:\dppjd.exe48⤵
- Executes dropped EXE
PID:1872 -
\??\c:\ffxrffx.exec:\ffxrffx.exe49⤵
- Executes dropped EXE
PID:332 -
\??\c:\9hhbth.exec:\9hhbth.exe50⤵
- Executes dropped EXE
PID:3924 -
\??\c:\jvdpj.exec:\jvdpj.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4268 -
\??\c:\jppjp.exec:\jppjp.exe52⤵
- Executes dropped EXE
PID:3912 -
\??\c:\xrrfxrr.exec:\xrrfxrr.exe53⤵
- Executes dropped EXE
PID:4840 -
\??\c:\htnhtt.exec:\htnhtt.exe54⤵
- Executes dropped EXE
PID:1320 -
\??\c:\dvdpd.exec:\dvdpd.exe55⤵
- Executes dropped EXE
PID:3528 -
\??\c:\9pjdd.exec:\9pjdd.exe56⤵
- Executes dropped EXE
PID:2928 -
\??\c:\7lrfxxr.exec:\7lrfxxr.exe57⤵
- Executes dropped EXE
PID:3540 -
\??\c:\bnhbtt.exec:\bnhbtt.exe58⤵
- Executes dropped EXE
PID:4928 -
\??\c:\vppjd.exec:\vppjd.exe59⤵
- Executes dropped EXE
PID:3452 -
\??\c:\vjdjd.exec:\vjdjd.exe60⤵
- Executes dropped EXE
PID:3396 -
\??\c:\9rlfrxr.exec:\9rlfrxr.exe61⤵
- Executes dropped EXE
PID:2024 -
\??\c:\nnnhbb.exec:\nnnhbb.exe62⤵
- Executes dropped EXE
PID:3596 -
\??\c:\pdjdd.exec:\pdjdd.exe63⤵
- Executes dropped EXE
PID:3488 -
\??\c:\rrrfxxl.exec:\rrrfxxl.exe64⤵
- Executes dropped EXE
PID:944 -
\??\c:\ttnhbb.exec:\ttnhbb.exe65⤵
- Executes dropped EXE
PID:3092 -
\??\c:\7nthbb.exec:\7nthbb.exe66⤵PID:3956
-
\??\c:\1vpjd.exec:\1vpjd.exe67⤵PID:1592
-
\??\c:\xfffllx.exec:\xfffllx.exe68⤵PID:1052
-
\??\c:\1nntth.exec:\1nntth.exe69⤵PID:5004
-
\??\c:\3ddvp.exec:\3ddvp.exe70⤵PID:220
-
\??\c:\ppvvd.exec:\ppvvd.exe71⤵PID:3124
-
\??\c:\xfrrrrr.exec:\xfrrrrr.exe72⤵
- System Location Discovery: System Language Discovery
PID:4968 -
\??\c:\ntbnnb.exec:\ntbnnb.exe73⤵PID:2500
-
\??\c:\dpddv.exec:\dpddv.exe74⤵PID:2328
-
\??\c:\ffxrrll.exec:\ffxrrll.exe75⤵PID:4372
-
\??\c:\xfxrffl.exec:\xfxrffl.exe76⤵PID:3860
-
\??\c:\bnhbnn.exec:\bnhbnn.exe77⤵PID:5012
-
\??\c:\vvdvv.exec:\vvdvv.exe78⤵PID:5088
-
\??\c:\xrrrlff.exec:\xrrrlff.exe79⤵PID:3752
-
\??\c:\bbtnhh.exec:\bbtnhh.exe80⤵PID:3572
-
\??\c:\vppjj.exec:\vppjj.exe81⤵PID:4876
-
\??\c:\ddddv.exec:\ddddv.exe82⤵
- System Location Discovery: System Language Discovery
PID:5096 -
\??\c:\rxrxllf.exec:\rxrxllf.exe83⤵PID:3772
-
\??\c:\bbbbbb.exec:\bbbbbb.exe84⤵PID:4588
-
\??\c:\ppvpp.exec:\ppvpp.exe85⤵PID:4904
-
\??\c:\lfrxlxf.exec:\lfrxlxf.exe86⤵PID:1860
-
\??\c:\nnnhbh.exec:\nnnhbh.exe87⤵PID:4644
-
\??\c:\5vdpv.exec:\5vdpv.exe88⤵PID:3996
-
\??\c:\xfrllrr.exec:\xfrllrr.exe89⤵PID:3976
-
\??\c:\xrrlffx.exec:\xrrlffx.exe90⤵PID:4536
-
\??\c:\tnttnn.exec:\tnttnn.exe91⤵PID:880
-
\??\c:\jjjdv.exec:\jjjdv.exe92⤵PID:3232
-
\??\c:\lxxrllx.exec:\lxxrllx.exe93⤵PID:1832
-
\??\c:\rfrxlxr.exec:\rfrxlxr.exe94⤵PID:1572
-
\??\c:\bnthbt.exec:\bnthbt.exe95⤵PID:1772
-
\??\c:\ddjpd.exec:\ddjpd.exe96⤵PID:1608
-
\??\c:\fxrlffx.exec:\fxrlffx.exe97⤵PID:2992
-
\??\c:\fxfxrlx.exec:\fxfxrlx.exe98⤵PID:1960
-
\??\c:\7nhhth.exec:\7nhhth.exe99⤵PID:1676
-
\??\c:\1pdvp.exec:\1pdvp.exe100⤵PID:2776
-
\??\c:\lrfxrrl.exec:\lrfxrrl.exe101⤵PID:2624
-
\??\c:\tbhtht.exec:\tbhtht.exe102⤵PID:4724
-
\??\c:\7ttttt.exec:\7ttttt.exe103⤵PID:760
-
\??\c:\ppdvp.exec:\ppdvp.exe104⤵PID:4048
-
\??\c:\pjvpj.exec:\pjvpj.exe105⤵PID:408
-
\??\c:\xlfllxl.exec:\xlfllxl.exe106⤵PID:400
-
\??\c:\bnnbtt.exec:\bnnbtt.exe107⤵PID:4884
-
\??\c:\vjdvv.exec:\vjdvv.exe108⤵PID:4504
-
\??\c:\rxrlfrl.exec:\rxrlfrl.exe109⤵PID:4732
-
\??\c:\3lrllxr.exec:\3lrllxr.exe110⤵PID:4400
-
\??\c:\ttnhbt.exec:\ttnhbt.exe111⤵PID:332
-
\??\c:\jpvvp.exec:\jpvvp.exe112⤵PID:960
-
\??\c:\flffffl.exec:\flffffl.exe113⤵PID:4268
-
\??\c:\tntnhh.exec:\tntnhh.exe114⤵PID:3912
-
\??\c:\htthbt.exec:\htthbt.exe115⤵PID:5044
-
\??\c:\pdddv.exec:\pdddv.exe116⤵PID:4388
-
\??\c:\lxxrrrl.exec:\lxxrrrl.exe117⤵PID:2088
-
\??\c:\httnhh.exec:\httnhh.exe118⤵PID:3252
-
\??\c:\jdjjj.exec:\jdjjj.exe119⤵PID:2432
-
\??\c:\dddvj.exec:\dddvj.exe120⤵PID:3668
-
\??\c:\lxlfllr.exec:\lxlfllr.exe121⤵PID:3872
-
\??\c:\ttbbhh.exec:\ttbbhh.exe122⤵PID:4648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-