Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bcd245407e7de930f2f59ba81d7ecf227ac5d26778dfeb7e6a65ba17fe6a497bN.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
bcd245407e7de930f2f59ba81d7ecf227ac5d26778dfeb7e6a65ba17fe6a497bN.exe
-
Size
456KB
-
MD5
ae1f2923021b0174404ccb041ad8b6a0
-
SHA1
ef7d89b7da61987fe922fd8f153c57bc90396cc9
-
SHA256
bcd245407e7de930f2f59ba81d7ecf227ac5d26778dfeb7e6a65ba17fe6a497b
-
SHA512
5c8719c5a48908a8a34abfca3704af365443fa76e5927ff0a39772eb4d8201a5cbbce47a802f99595fef1c723d2bd9c117d85c2b79c85eee85160eebda601185
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRp:q7Tc2NYHUrAwfMp3CDRp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2460-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2780-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/528-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/992-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2772-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3376-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/744-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/884-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1628-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1856-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2916-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3300-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/812-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1912-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2980-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3544-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/768-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-653-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-758-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-816-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-920-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-945-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-949-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-971-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2796 5hhbbh.exe 2780 btbbhh.exe 3920 pjjjj.exe 3656 hhhtnh.exe 528 rrffffx.exe 3116 frfxllf.exe 2692 bnttnt.exe 1376 jjjjd.exe 992 xxrxlfr.exe 348 vjppp.exe 3664 nthhbb.exe 1608 1rxfxxx.exe 392 nhnhnn.exe 396 5jjdv.exe 3852 7rrllrr.exe 2496 ppjdd.exe 4984 pdjdv.exe 2772 bbbtnn.exe 1916 3jpjj.exe 2928 rrlllrl.exe 3196 5nttnn.exe 3376 fffflxx.exe 3940 bthntb.exe 4868 bbhbnn.exe 4212 jdddd.exe 744 pdvvp.exe 1580 frxrrlf.exe 2200 djjdp.exe 4752 bhtnbt.exe 884 3fxxrxx.exe 1720 tntttt.exe 1628 9vdvp.exe 3520 5btnhn.exe 3452 rflfxxr.exe 2800 5lrrxff.exe 4360 7ttnhh.exe 1688 dvvvp.exe 1576 llrlffx.exe 3732 1tbbbb.exe 4788 pdjjj.exe 3236 rllfxxx.exe 4544 ttbttt.exe 3924 7vddp.exe 2660 fxlflxl.exe 2936 7ntbth.exe 3292 ppdvd.exe 2472 5xxrllf.exe 2004 nbbtnh.exe 1856 1ddvv.exe 2104 ffrrllf.exe 2176 frlrfrf.exe 5020 jjpvv.exe 2796 rlrrrff.exe 4932 5lrxxrx.exe 720 bnnhbn.exe 2916 1ppjd.exe 2288 lfllfff.exe 3656 ddvpv.exe 848 vpppp.exe 3148 7lrrllf.exe 1088 bnnhbh.exe 2376 ppdjd.exe 1800 lflffff.exe 2784 nhhbtb.exe -
resource yara_rule behavioral2/memory/2460-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2780-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/528-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/992-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2772-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3376-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/744-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/884-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1628-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1856-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2916-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3300-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/812-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1912-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2980-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3544-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/768-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-758-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-816-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-920-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxlfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrfrf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2796 2460 bcd245407e7de930f2f59ba81d7ecf227ac5d26778dfeb7e6a65ba17fe6a497bN.exe 82 PID 2460 wrote to memory of 2796 2460 bcd245407e7de930f2f59ba81d7ecf227ac5d26778dfeb7e6a65ba17fe6a497bN.exe 82 PID 2460 wrote to memory of 2796 2460 bcd245407e7de930f2f59ba81d7ecf227ac5d26778dfeb7e6a65ba17fe6a497bN.exe 82 PID 2796 wrote to memory of 2780 2796 5hhbbh.exe 83 PID 2796 wrote to memory of 2780 2796 5hhbbh.exe 83 PID 2796 wrote to memory of 2780 2796 5hhbbh.exe 83 PID 2780 wrote to memory of 3920 2780 btbbhh.exe 84 PID 2780 wrote to memory of 3920 2780 btbbhh.exe 84 PID 2780 wrote to memory of 3920 2780 btbbhh.exe 84 PID 3920 wrote to memory of 3656 3920 pjjjj.exe 85 PID 3920 wrote to memory of 3656 3920 pjjjj.exe 85 PID 3920 wrote to memory of 3656 3920 pjjjj.exe 85 PID 3656 wrote to memory of 528 3656 hhhtnh.exe 86 PID 3656 wrote to memory of 528 3656 hhhtnh.exe 86 PID 3656 wrote to memory of 528 3656 hhhtnh.exe 86 PID 528 wrote to memory of 3116 528 rrffffx.exe 87 PID 528 wrote to memory of 3116 528 rrffffx.exe 87 PID 528 wrote to memory of 3116 528 rrffffx.exe 87 PID 3116 wrote to memory of 2692 3116 frfxllf.exe 88 PID 3116 wrote to memory of 2692 3116 frfxllf.exe 88 PID 3116 wrote to memory of 2692 3116 frfxllf.exe 88 PID 2692 wrote to memory of 1376 2692 bnttnt.exe 89 PID 2692 wrote to memory of 1376 2692 bnttnt.exe 89 PID 2692 wrote to memory of 1376 2692 bnttnt.exe 89 PID 1376 wrote to memory of 992 1376 jjjjd.exe 90 PID 1376 wrote to memory of 992 1376 jjjjd.exe 90 PID 1376 wrote to memory of 992 1376 jjjjd.exe 90 PID 992 wrote to memory of 348 992 xxrxlfr.exe 91 PID 992 wrote to memory of 348 992 xxrxlfr.exe 91 PID 992 wrote to memory of 348 992 xxrxlfr.exe 91 PID 348 wrote to memory of 3664 348 vjppp.exe 92 PID 348 wrote to memory of 3664 348 vjppp.exe 92 PID 348 wrote to memory of 3664 348 vjppp.exe 92 PID 3664 wrote to memory of 1608 3664 nthhbb.exe 93 PID 3664 wrote to memory of 1608 3664 nthhbb.exe 93 PID 3664 wrote to memory of 1608 3664 nthhbb.exe 93 PID 1608 wrote to memory of 392 1608 1rxfxxx.exe 94 PID 1608 wrote to memory of 392 1608 1rxfxxx.exe 94 PID 1608 wrote to memory of 392 1608 1rxfxxx.exe 94 PID 392 wrote to memory of 396 392 nhnhnn.exe 95 PID 392 wrote to memory of 396 392 nhnhnn.exe 95 PID 392 wrote to memory of 396 392 nhnhnn.exe 95 PID 396 wrote to memory of 3852 396 5jjdv.exe 96 PID 396 wrote to memory of 3852 396 5jjdv.exe 96 PID 396 wrote to memory of 3852 396 5jjdv.exe 96 PID 3852 wrote to memory of 2496 3852 7rrllrr.exe 97 PID 3852 wrote to memory of 2496 3852 7rrllrr.exe 97 PID 3852 wrote to memory of 2496 3852 7rrllrr.exe 97 PID 2496 wrote to memory of 4984 2496 ppjdd.exe 98 PID 2496 wrote to memory of 4984 2496 ppjdd.exe 98 PID 2496 wrote to memory of 4984 2496 ppjdd.exe 98 PID 4984 wrote to memory of 2772 4984 pdjdv.exe 99 PID 4984 wrote to memory of 2772 4984 pdjdv.exe 99 PID 4984 wrote to memory of 2772 4984 pdjdv.exe 99 PID 2772 wrote to memory of 1916 2772 bbbtnn.exe 100 PID 2772 wrote to memory of 1916 2772 bbbtnn.exe 100 PID 2772 wrote to memory of 1916 2772 bbbtnn.exe 100 PID 1916 wrote to memory of 2928 1916 3jpjj.exe 101 PID 1916 wrote to memory of 2928 1916 3jpjj.exe 101 PID 1916 wrote to memory of 2928 1916 3jpjj.exe 101 PID 2928 wrote to memory of 3196 2928 rrlllrl.exe 102 PID 2928 wrote to memory of 3196 2928 rrlllrl.exe 102 PID 2928 wrote to memory of 3196 2928 rrlllrl.exe 102 PID 3196 wrote to memory of 3376 3196 5nttnn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcd245407e7de930f2f59ba81d7ecf227ac5d26778dfeb7e6a65ba17fe6a497bN.exe"C:\Users\Admin\AppData\Local\Temp\bcd245407e7de930f2f59ba81d7ecf227ac5d26778dfeb7e6a65ba17fe6a497bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\5hhbbh.exec:\5hhbbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\btbbhh.exec:\btbbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\pjjjj.exec:\pjjjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\hhhtnh.exec:\hhhtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\rrffffx.exec:\rrffffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\frfxllf.exec:\frfxllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\bnttnt.exec:\bnttnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\jjjjd.exec:\jjjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\xxrxlfr.exec:\xxrxlfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\vjppp.exec:\vjppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\nthhbb.exec:\nthhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\1rxfxxx.exec:\1rxfxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\nhnhnn.exec:\nhnhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\5jjdv.exec:\5jjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\7rrllrr.exec:\7rrllrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\ppjdd.exec:\ppjdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\pdjdv.exec:\pdjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\bbbtnn.exec:\bbbtnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\3jpjj.exec:\3jpjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\rrlllrl.exec:\rrlllrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\5nttnn.exec:\5nttnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\fffflxx.exec:\fffflxx.exe23⤵
- Executes dropped EXE
PID:3376 -
\??\c:\bthntb.exec:\bthntb.exe24⤵
- Executes dropped EXE
PID:3940 -
\??\c:\bbhbnn.exec:\bbhbnn.exe25⤵
- Executes dropped EXE
PID:4868 -
\??\c:\jdddd.exec:\jdddd.exe26⤵
- Executes dropped EXE
PID:4212 -
\??\c:\pdvvp.exec:\pdvvp.exe27⤵
- Executes dropped EXE
PID:744 -
\??\c:\frxrrlf.exec:\frxrrlf.exe28⤵
- Executes dropped EXE
PID:1580 -
\??\c:\djjdp.exec:\djjdp.exe29⤵
- Executes dropped EXE
PID:2200 -
\??\c:\bhtnbt.exec:\bhtnbt.exe30⤵
- Executes dropped EXE
PID:4752 -
\??\c:\3fxxrxx.exec:\3fxxrxx.exe31⤵
- Executes dropped EXE
PID:884 -
\??\c:\tntttt.exec:\tntttt.exe32⤵
- Executes dropped EXE
PID:1720 -
\??\c:\9vdvp.exec:\9vdvp.exe33⤵
- Executes dropped EXE
PID:1628 -
\??\c:\5btnhn.exec:\5btnhn.exe34⤵
- Executes dropped EXE
PID:3520 -
\??\c:\rflfxxr.exec:\rflfxxr.exe35⤵
- Executes dropped EXE
PID:3452 -
\??\c:\5lrrxff.exec:\5lrrxff.exe36⤵
- Executes dropped EXE
PID:2800 -
\??\c:\7ttnhh.exec:\7ttnhh.exe37⤵
- Executes dropped EXE
PID:4360 -
\??\c:\dvvvp.exec:\dvvvp.exe38⤵
- Executes dropped EXE
PID:1688 -
\??\c:\llrlffx.exec:\llrlffx.exe39⤵
- Executes dropped EXE
PID:1576 -
\??\c:\1tbbbb.exec:\1tbbbb.exe40⤵
- Executes dropped EXE
PID:3732 -
\??\c:\pdjjj.exec:\pdjjj.exe41⤵
- Executes dropped EXE
PID:4788 -
\??\c:\rllfxxx.exec:\rllfxxx.exe42⤵
- Executes dropped EXE
PID:3236 -
\??\c:\ttbttt.exec:\ttbttt.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4544 -
\??\c:\7vddp.exec:\7vddp.exe44⤵
- Executes dropped EXE
PID:3924 -
\??\c:\fxlflxl.exec:\fxlflxl.exe45⤵
- Executes dropped EXE
PID:2660 -
\??\c:\7ntbth.exec:\7ntbth.exe46⤵
- Executes dropped EXE
PID:2936 -
\??\c:\ppdvd.exec:\ppdvd.exe47⤵
- Executes dropped EXE
PID:3292 -
\??\c:\5xxrllf.exec:\5xxrllf.exe48⤵
- Executes dropped EXE
PID:2472 -
\??\c:\nbbtnh.exec:\nbbtnh.exe49⤵
- Executes dropped EXE
PID:2004 -
\??\c:\1ddvv.exec:\1ddvv.exe50⤵
- Executes dropped EXE
PID:1856 -
\??\c:\ffrrllf.exec:\ffrrllf.exe51⤵
- Executes dropped EXE
PID:2104 -
\??\c:\frlrfrf.exec:\frlrfrf.exe52⤵
- Executes dropped EXE
PID:2176 -
\??\c:\jjpvv.exec:\jjpvv.exe53⤵
- Executes dropped EXE
PID:5020 -
\??\c:\rlrrrff.exec:\rlrrrff.exe54⤵
- Executes dropped EXE
PID:2796 -
\??\c:\5lrxxrx.exec:\5lrxxrx.exe55⤵
- Executes dropped EXE
PID:4932 -
\??\c:\bnnhbn.exec:\bnnhbn.exe56⤵
- Executes dropped EXE
PID:720 -
\??\c:\1ppjd.exec:\1ppjd.exe57⤵
- Executes dropped EXE
PID:2916 -
\??\c:\lfllfff.exec:\lfllfff.exe58⤵
- Executes dropped EXE
PID:2288 -
\??\c:\ddvpv.exec:\ddvpv.exe59⤵
- Executes dropped EXE
PID:3656 -
\??\c:\vpppp.exec:\vpppp.exe60⤵
- Executes dropped EXE
PID:848 -
\??\c:\7lrrllf.exec:\7lrrllf.exe61⤵
- Executes dropped EXE
PID:3148 -
\??\c:\bnnhbh.exec:\bnnhbh.exe62⤵
- Executes dropped EXE
PID:1088 -
\??\c:\ppdjd.exec:\ppdjd.exe63⤵
- Executes dropped EXE
PID:2376 -
\??\c:\lflffff.exec:\lflffff.exe64⤵
- Executes dropped EXE
PID:1800 -
\??\c:\nhhbtb.exec:\nhhbtb.exe65⤵
- Executes dropped EXE
PID:2784 -
\??\c:\ppdpv.exec:\ppdpv.exe66⤵PID:948
-
\??\c:\vpdpj.exec:\vpdpj.exe67⤵PID:208
-
\??\c:\bttbnh.exec:\bttbnh.exe68⤵PID:3136
-
\??\c:\pjddp.exec:\pjddp.exe69⤵PID:2012
-
\??\c:\jjdvj.exec:\jjdvj.exe70⤵PID:1976
-
\??\c:\xlrlfff.exec:\xlrlfff.exe71⤵PID:4872
-
\??\c:\nnnnnn.exec:\nnnnnn.exe72⤵PID:5008
-
\??\c:\ppdjv.exec:\ppdjv.exe73⤵PID:1312
-
\??\c:\xxfxlrf.exec:\xxfxlrf.exe74⤵PID:4372
-
\??\c:\hbhhbh.exec:\hbhhbh.exe75⤵PID:224
-
\??\c:\jdvvp.exec:\jdvvp.exe76⤵PID:2232
-
\??\c:\rffffrx.exec:\rffffrx.exe77⤵PID:1112
-
\??\c:\xlrrrrx.exec:\xlrrrrx.exe78⤵PID:3740
-
\??\c:\tbttth.exec:\tbttth.exe79⤵PID:3300
-
\??\c:\dvjjd.exec:\dvjjd.exe80⤵PID:812
-
\??\c:\3ffxrlf.exec:\3ffxrlf.exe81⤵PID:1648
-
\??\c:\btbbhn.exec:\btbbhn.exe82⤵PID:1912
-
\??\c:\vpvdv.exec:\vpvdv.exe83⤵PID:408
-
\??\c:\5pvpp.exec:\5pvpp.exe84⤵PID:3720
-
\??\c:\xllflfx.exec:\xllflfx.exe85⤵PID:4836
-
\??\c:\tthtnh.exec:\tthtnh.exe86⤵PID:4840
-
\??\c:\vpvjj.exec:\vpvjj.exe87⤵PID:3996
-
\??\c:\rflffxr.exec:\rflffxr.exe88⤵PID:1356
-
\??\c:\nnbthh.exec:\nnbthh.exe89⤵PID:2980
-
\??\c:\bnthht.exec:\bnthht.exe90⤵PID:2892
-
\??\c:\jvjdv.exec:\jvjdv.exe91⤵PID:1580
-
\??\c:\xflrrfl.exec:\xflrrfl.exe92⤵PID:332
-
\??\c:\7ttnhh.exec:\7ttnhh.exe93⤵PID:2996
-
\??\c:\5dpjj.exec:\5dpjj.exe94⤵PID:1640
-
\??\c:\rflfxxx.exec:\rflfxxx.exe95⤵PID:3120
-
\??\c:\tthbbb.exec:\tthbbb.exe96⤵PID:1168
-
\??\c:\ppjvd.exec:\ppjvd.exe97⤵PID:3328
-
\??\c:\lrxlfrl.exec:\lrxlfrl.exe98⤵
- System Location Discovery: System Language Discovery
PID:1628 -
\??\c:\3bhbtt.exec:\3bhbtt.exe99⤵PID:1248
-
\??\c:\hhbbbh.exec:\hhbbbh.exe100⤵PID:4896
-
\??\c:\vvpvv.exec:\vvpvv.exe101⤵PID:3164
-
\??\c:\rrlxlfr.exec:\rrlxlfr.exe102⤵PID:1456
-
\??\c:\tntnbn.exec:\tntnbn.exe103⤵PID:4820
-
\??\c:\pjdvv.exec:\pjdvv.exe104⤵PID:3672
-
\??\c:\jppdv.exec:\jppdv.exe105⤵PID:1540
-
\??\c:\fxxlffx.exec:\fxxlffx.exe106⤵PID:4788
-
\??\c:\nhhnht.exec:\nhhnht.exe107⤵PID:3236
-
\??\c:\ddjjj.exec:\ddjjj.exe108⤵PID:2196
-
\??\c:\lrxrlll.exec:\lrxrlll.exe109⤵PID:4620
-
\??\c:\3tbttt.exec:\3tbttt.exe110⤵PID:2212
-
\??\c:\3vddd.exec:\3vddd.exe111⤵PID:2936
-
\??\c:\rflffff.exec:\rflffff.exe112⤵PID:4644
-
\??\c:\nbnhnt.exec:\nbnhnt.exe113⤵PID:4504
-
\??\c:\pjjdd.exec:\pjjdd.exe114⤵PID:4388
-
\??\c:\rffxxff.exec:\rffxxff.exe115⤵PID:1856
-
\??\c:\3hhbth.exec:\3hhbth.exe116⤵PID:3856
-
\??\c:\vpdpv.exec:\vpdpv.exe117⤵PID:2808
-
\??\c:\dpppp.exec:\dpppp.exe118⤵PID:5020
-
\??\c:\7xxrllf.exec:\7xxrllf.exe119⤵PID:3652
-
\??\c:\nbttnt.exec:\nbttnt.exe120⤵PID:4936
-
\??\c:\3tnnnn.exec:\3tnnnn.exe121⤵PID:4664
-
\??\c:\1jjpj.exec:\1jjpj.exe122⤵PID:4396
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-