Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2025, 05:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eb9eeb3891190ef94f68e8919ff3c3bc3245bec907e5135f0999097fdb9aacd6.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
eb9eeb3891190ef94f68e8919ff3c3bc3245bec907e5135f0999097fdb9aacd6.exe
-
Size
454KB
-
MD5
8f03764f6dcee305019066c09f9fbd5a
-
SHA1
02167e8756476b49a9b7e3dd9398c0677480fe69
-
SHA256
eb9eeb3891190ef94f68e8919ff3c3bc3245bec907e5135f0999097fdb9aacd6
-
SHA512
8f98d3ff80cca20700d0cd001b6c140d3ace3aa3c63b350174a758ab8e987aa20c235c0f7b83ed9d3fd5e864a9919b037310d1deade788ac23607e30e9c22a42
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe6y:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1156-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4272-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1320-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/440-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/684-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/964-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2988-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3004-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1680-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3804-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/852-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2812-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2632-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3048-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-801-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-850-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-872-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-927-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-965-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-988-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-1492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-1552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 628 bhhbtb.exe 4356 24408.exe 4272 ffrxlxx.exe 3588 462222.exe 1560 66264.exe 1320 e46048.exe 2880 086660.exe 592 e60040.exe 440 tnhnhn.exe 1552 44488.exe 4948 7jjdv.exe 684 hhnhbb.exe 624 bnnnhn.exe 964 0404448.exe 5060 fxlfxlx.exe 2988 lxfxrrr.exe 3392 5bnbhh.exe 2052 662222.exe 4988 bbbbtb.exe 2432 0682226.exe 2544 5ttnhh.exe 3004 tntthb.exe 4112 lfflflr.exe 2764 xlxxxfx.exe 4520 rxllflx.exe 1680 40046.exe 2800 40660.exe 376 2688484.exe 2968 48226.exe 1160 40420.exe 1912 k28260.exe 468 3bbthb.exe 3852 vjpjp.exe 1128 lxxlxlx.exe 3804 62820.exe 2972 7bhthb.exe 1580 xrfrfxl.exe 1112 lxrfrlf.exe 3516 402408.exe 5116 082040.exe 4420 8622448.exe 852 flxlrfr.exe 1376 tnbtnb.exe 864 48462.exe 3976 hbtntt.exe 4580 xxxrllf.exe 2576 9lllffx.exe 3572 btttbh.exe 4912 5dvpp.exe 4872 o848660.exe 3580 26882.exe 2812 86826.exe 4412 6600088.exe 3940 2604428.exe 3964 2840444.exe 4072 lflrrrl.exe 2072 ntbnhn.exe 4948 5bhtnn.exe 3044 nnhhbb.exe 1252 q62644.exe 624 6664464.exe 2584 frrffxl.exe 4064 646060.exe 3160 lxrlllf.exe -
resource yara_rule behavioral2/memory/1156-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4272-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1320-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/440-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/684-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/964-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2988-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1680-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3804-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/852-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2348-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/512-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-801-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-850-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-927-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6888804.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4826826.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 880640.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24088.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 204806.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86826.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u626648.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2684484.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86862.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1156 wrote to memory of 628 1156 eb9eeb3891190ef94f68e8919ff3c3bc3245bec907e5135f0999097fdb9aacd6.exe 83 PID 1156 wrote to memory of 628 1156 eb9eeb3891190ef94f68e8919ff3c3bc3245bec907e5135f0999097fdb9aacd6.exe 83 PID 1156 wrote to memory of 628 1156 eb9eeb3891190ef94f68e8919ff3c3bc3245bec907e5135f0999097fdb9aacd6.exe 83 PID 628 wrote to memory of 4356 628 bhhbtb.exe 84 PID 628 wrote to memory of 4356 628 bhhbtb.exe 84 PID 628 wrote to memory of 4356 628 bhhbtb.exe 84 PID 4356 wrote to memory of 4272 4356 24408.exe 85 PID 4356 wrote to memory of 4272 4356 24408.exe 85 PID 4356 wrote to memory of 4272 4356 24408.exe 85 PID 4272 wrote to memory of 3588 4272 ffrxlxx.exe 86 PID 4272 wrote to memory of 3588 4272 ffrxlxx.exe 86 PID 4272 wrote to memory of 3588 4272 ffrxlxx.exe 86 PID 3588 wrote to memory of 1560 3588 462222.exe 87 PID 3588 wrote to memory of 1560 3588 462222.exe 87 PID 3588 wrote to memory of 1560 3588 462222.exe 87 PID 1560 wrote to memory of 1320 1560 66264.exe 88 PID 1560 wrote to memory of 1320 1560 66264.exe 88 PID 1560 wrote to memory of 1320 1560 66264.exe 88 PID 1320 wrote to memory of 2880 1320 e46048.exe 89 PID 1320 wrote to memory of 2880 1320 e46048.exe 89 PID 1320 wrote to memory of 2880 1320 e46048.exe 89 PID 2880 wrote to memory of 592 2880 086660.exe 90 PID 2880 wrote to memory of 592 2880 086660.exe 90 PID 2880 wrote to memory of 592 2880 086660.exe 90 PID 592 wrote to memory of 440 592 e60040.exe 91 PID 592 wrote to memory of 440 592 e60040.exe 91 PID 592 wrote to memory of 440 592 e60040.exe 91 PID 440 wrote to memory of 1552 440 tnhnhn.exe 92 PID 440 wrote to memory of 1552 440 tnhnhn.exe 92 PID 440 wrote to memory of 1552 440 tnhnhn.exe 92 PID 1552 wrote to memory of 4948 1552 44488.exe 93 PID 1552 wrote to memory of 4948 1552 44488.exe 93 PID 1552 wrote to memory of 4948 1552 44488.exe 93 PID 4948 wrote to memory of 684 4948 7jjdv.exe 94 PID 4948 wrote to memory of 684 4948 7jjdv.exe 94 PID 4948 wrote to memory of 684 4948 7jjdv.exe 94 PID 684 wrote to memory of 624 684 hhnhbb.exe 95 PID 684 wrote to memory of 624 684 hhnhbb.exe 95 PID 684 wrote to memory of 624 684 hhnhbb.exe 95 PID 624 wrote to memory of 964 624 bnnnhn.exe 96 PID 624 wrote to memory of 964 624 bnnnhn.exe 96 PID 624 wrote to memory of 964 624 bnnnhn.exe 96 PID 964 wrote to memory of 5060 964 0404448.exe 97 PID 964 wrote to memory of 5060 964 0404448.exe 97 PID 964 wrote to memory of 5060 964 0404448.exe 97 PID 5060 wrote to memory of 2988 5060 fxlfxlx.exe 98 PID 5060 wrote to memory of 2988 5060 fxlfxlx.exe 98 PID 5060 wrote to memory of 2988 5060 fxlfxlx.exe 98 PID 2988 wrote to memory of 3392 2988 lxfxrrr.exe 99 PID 2988 wrote to memory of 3392 2988 lxfxrrr.exe 99 PID 2988 wrote to memory of 3392 2988 lxfxrrr.exe 99 PID 3392 wrote to memory of 2052 3392 5bnbhh.exe 100 PID 3392 wrote to memory of 2052 3392 5bnbhh.exe 100 PID 3392 wrote to memory of 2052 3392 5bnbhh.exe 100 PID 2052 wrote to memory of 4988 2052 662222.exe 101 PID 2052 wrote to memory of 4988 2052 662222.exe 101 PID 2052 wrote to memory of 4988 2052 662222.exe 101 PID 4988 wrote to memory of 2432 4988 bbbbtb.exe 102 PID 4988 wrote to memory of 2432 4988 bbbbtb.exe 102 PID 4988 wrote to memory of 2432 4988 bbbbtb.exe 102 PID 2432 wrote to memory of 2544 2432 0682226.exe 103 PID 2432 wrote to memory of 2544 2432 0682226.exe 103 PID 2432 wrote to memory of 2544 2432 0682226.exe 103 PID 2544 wrote to memory of 3004 2544 5ttnhh.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb9eeb3891190ef94f68e8919ff3c3bc3245bec907e5135f0999097fdb9aacd6.exe"C:\Users\Admin\AppData\Local\Temp\eb9eeb3891190ef94f68e8919ff3c3bc3245bec907e5135f0999097fdb9aacd6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\bhhbtb.exec:\bhhbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\24408.exec:\24408.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\ffrxlxx.exec:\ffrxlxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\462222.exec:\462222.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\66264.exec:\66264.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\e46048.exec:\e46048.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\086660.exec:\086660.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\e60040.exec:\e60040.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\tnhnhn.exec:\tnhnhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\44488.exec:\44488.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\7jjdv.exec:\7jjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\hhnhbb.exec:\hhnhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\bnnnhn.exec:\bnnnhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\0404448.exec:\0404448.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\fxlfxlx.exec:\fxlfxlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\lxfxrrr.exec:\lxfxrrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\5bnbhh.exec:\5bnbhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\662222.exec:\662222.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\bbbbtb.exec:\bbbbtb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\0682226.exec:\0682226.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\5ttnhh.exec:\5ttnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\tntthb.exec:\tntthb.exe23⤵
- Executes dropped EXE
PID:3004 -
\??\c:\lfflflr.exec:\lfflflr.exe24⤵
- Executes dropped EXE
PID:4112 -
\??\c:\xlxxxfx.exec:\xlxxxfx.exe25⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rxllflx.exec:\rxllflx.exe26⤵
- Executes dropped EXE
PID:4520 -
\??\c:\40046.exec:\40046.exe27⤵
- Executes dropped EXE
PID:1680 -
\??\c:\40660.exec:\40660.exe28⤵
- Executes dropped EXE
PID:2800 -
\??\c:\2688484.exec:\2688484.exe29⤵
- Executes dropped EXE
PID:376 -
\??\c:\48226.exec:\48226.exe30⤵
- Executes dropped EXE
PID:2968 -
\??\c:\40420.exec:\40420.exe31⤵
- Executes dropped EXE
PID:1160 -
\??\c:\k28260.exec:\k28260.exe32⤵
- Executes dropped EXE
PID:1912 -
\??\c:\3bbthb.exec:\3bbthb.exe33⤵
- Executes dropped EXE
PID:468 -
\??\c:\vjpjp.exec:\vjpjp.exe34⤵
- Executes dropped EXE
PID:3852 -
\??\c:\lxxlxlx.exec:\lxxlxlx.exe35⤵
- Executes dropped EXE
PID:1128 -
\??\c:\62820.exec:\62820.exe36⤵
- Executes dropped EXE
PID:3804 -
\??\c:\7bhthb.exec:\7bhthb.exe37⤵
- Executes dropped EXE
PID:2972 -
\??\c:\xrfrfxl.exec:\xrfrfxl.exe38⤵
- Executes dropped EXE
PID:1580 -
\??\c:\lxrfrlf.exec:\lxrfrlf.exe39⤵
- Executes dropped EXE
PID:1112 -
\??\c:\402408.exec:\402408.exe40⤵
- Executes dropped EXE
PID:3516 -
\??\c:\082040.exec:\082040.exe41⤵
- Executes dropped EXE
PID:5116 -
\??\c:\8622448.exec:\8622448.exe42⤵
- Executes dropped EXE
PID:4420 -
\??\c:\flxlrfr.exec:\flxlrfr.exe43⤵
- Executes dropped EXE
PID:852 -
\??\c:\tnbtnb.exec:\tnbtnb.exe44⤵
- Executes dropped EXE
PID:1376 -
\??\c:\48462.exec:\48462.exe45⤵
- Executes dropped EXE
PID:864 -
\??\c:\hbtntt.exec:\hbtntt.exe46⤵
- Executes dropped EXE
PID:3976 -
\??\c:\xxxrllf.exec:\xxxrllf.exe47⤵
- Executes dropped EXE
PID:4580 -
\??\c:\9lllffx.exec:\9lllffx.exe48⤵
- Executes dropped EXE
PID:2576 -
\??\c:\btttbh.exec:\btttbh.exe49⤵
- Executes dropped EXE
PID:3572 -
\??\c:\5dvpp.exec:\5dvpp.exe50⤵
- Executes dropped EXE
PID:4912 -
\??\c:\o848660.exec:\o848660.exe51⤵
- Executes dropped EXE
PID:4872 -
\??\c:\26882.exec:\26882.exe52⤵
- Executes dropped EXE
PID:3580 -
\??\c:\86826.exec:\86826.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2812 -
\??\c:\6600088.exec:\6600088.exe54⤵
- Executes dropped EXE
PID:4412 -
\??\c:\2604428.exec:\2604428.exe55⤵
- Executes dropped EXE
PID:3940 -
\??\c:\2840444.exec:\2840444.exe56⤵
- Executes dropped EXE
PID:3964 -
\??\c:\lflrrrl.exec:\lflrrrl.exe57⤵
- Executes dropped EXE
PID:4072 -
\??\c:\ntbnhn.exec:\ntbnhn.exe58⤵
- Executes dropped EXE
PID:2072 -
\??\c:\5bhtnn.exec:\5bhtnn.exe59⤵
- Executes dropped EXE
PID:4948 -
\??\c:\nnhhbb.exec:\nnhhbb.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3044 -
\??\c:\q62644.exec:\q62644.exe61⤵
- Executes dropped EXE
PID:1252 -
\??\c:\6664464.exec:\6664464.exe62⤵
- Executes dropped EXE
PID:624 -
\??\c:\frrffxl.exec:\frrffxl.exe63⤵
- Executes dropped EXE
PID:2584 -
\??\c:\646060.exec:\646060.exe64⤵
- Executes dropped EXE
PID:4064 -
\??\c:\lxrlllf.exec:\lxrlllf.exe65⤵
- Executes dropped EXE
PID:3160 -
\??\c:\dvdvv.exec:\dvdvv.exe66⤵PID:4540
-
\??\c:\420484.exec:\420484.exe67⤵PID:2428
-
\??\c:\0248266.exec:\0248266.exe68⤵PID:2340
-
\??\c:\4660484.exec:\4660484.exe69⤵PID:2632
-
\??\c:\9ddvp.exec:\9ddvp.exe70⤵PID:4116
-
\??\c:\s6260.exec:\s6260.exe71⤵PID:5064
-
\??\c:\26828.exec:\26828.exe72⤵PID:4512
-
\??\c:\xllfxrl.exec:\xllfxrl.exe73⤵PID:2432
-
\??\c:\60048.exec:\60048.exe74⤵PID:5112
-
\??\c:\g2440.exec:\g2440.exe75⤵PID:3048
-
\??\c:\2220482.exec:\2220482.exe76⤵PID:4140
-
\??\c:\286048.exec:\286048.exe77⤵PID:4828
-
\??\c:\s0204.exec:\s0204.exe78⤵PID:2764
-
\??\c:\88448.exec:\88448.exe79⤵PID:4520
-
\??\c:\7nnhbb.exec:\7nnhbb.exe80⤵PID:3252
-
\??\c:\nbnnnb.exec:\nbnnnb.exe81⤵PID:4596
-
\??\c:\m2048.exec:\m2048.exe82⤵PID:448
-
\??\c:\i642082.exec:\i642082.exe83⤵PID:3728
-
\??\c:\4226882.exec:\4226882.exe84⤵PID:8
-
\??\c:\280864.exec:\280864.exe85⤵PID:3900
-
\??\c:\006682.exec:\006682.exe86⤵PID:5088
-
\??\c:\tbnhnt.exec:\tbnhnt.exe87⤵PID:3932
-
\??\c:\5ntnbb.exec:\5ntnbb.exe88⤵PID:4960
-
\??\c:\7jdpj.exec:\7jdpj.exe89⤵PID:2452
-
\??\c:\pddvp.exec:\pddvp.exe90⤵PID:4388
-
\??\c:\lxxlfxr.exec:\lxxlfxr.exe91⤵PID:916
-
\??\c:\jpvvd.exec:\jpvvd.exe92⤵PID:3108
-
\??\c:\6004264.exec:\6004264.exe93⤵PID:3672
-
\??\c:\3xrlxxr.exec:\3xrlxxr.exe94⤵PID:1096
-
\??\c:\40042.exec:\40042.exe95⤵PID:1664
-
\??\c:\600282.exec:\600282.exe96⤵PID:4232
-
\??\c:\fxxrffx.exec:\fxxrffx.exe97⤵PID:4364
-
\??\c:\0846482.exec:\0846482.exe98⤵PID:2348
-
\??\c:\086048.exec:\086048.exe99⤵PID:2028
-
\??\c:\vjpdj.exec:\vjpdj.exe100⤵PID:512
-
\??\c:\08004.exec:\08004.exe101⤵PID:4444
-
\??\c:\u286826.exec:\u286826.exe102⤵PID:3212
-
\??\c:\8482042.exec:\8482042.exe103⤵PID:3756
-
\??\c:\m8060.exec:\m8060.exe104⤵PID:4288
-
\??\c:\dvvjp.exec:\dvvjp.exe105⤵PID:4332
-
\??\c:\k40864.exec:\k40864.exe106⤵PID:5080
-
\??\c:\26482.exec:\26482.exe107⤵PID:3472
-
\??\c:\466004.exec:\466004.exe108⤵PID:4040
-
\??\c:\26208.exec:\26208.exe109⤵PID:4356
-
\??\c:\20486.exec:\20486.exe110⤵PID:408
-
\??\c:\40826.exec:\40826.exe111⤵PID:4572
-
\??\c:\jjvpd.exec:\jjvpd.exe112⤵PID:3740
-
\??\c:\m4420.exec:\m4420.exe113⤵PID:1352
-
\??\c:\bbtnhb.exec:\bbtnhb.exe114⤵PID:452
-
\??\c:\64004.exec:\64004.exe115⤵PID:2880
-
\??\c:\pjdpj.exec:\pjdpj.exe116⤵PID:4276
-
\??\c:\7nnnhh.exec:\7nnnhh.exe117⤵PID:2248
-
\??\c:\pjjvj.exec:\pjjvj.exe118⤵PID:3940
-
\??\c:\e68248.exec:\e68248.exe119⤵PID:4076
-
\??\c:\24088.exec:\24088.exe120⤵
- System Location Discovery: System Language Discovery
PID:2648 -
\??\c:\6844288.exec:\6844288.exe121⤵PID:1300
-
\??\c:\0482042.exec:\0482042.exe122⤵PID:4948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-