Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/01/2025, 09:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b31919303b782dc458069a8d2d608240acae7f90ee71c7a2fe689e54373197b.exe
Resource
win7-20240729-en
7 signatures
120 seconds
General
-
Target
0b31919303b782dc458069a8d2d608240acae7f90ee71c7a2fe689e54373197b.exe
-
Size
455KB
-
MD5
7679a5cf47913efaa5eab51923ff3e76
-
SHA1
c267ba816f445206e5b25ddbc46cf0c6b8634831
-
SHA256
0b31919303b782dc458069a8d2d608240acae7f90ee71c7a2fe689e54373197b
-
SHA512
ce02e25c3aa6c2371e0a0dd424699ade0d677ed2792b1f8cdd22bd194684b55632715a375646d2b26e12a7e471b6f0a9664a21926aec21a24ec2571e453e7ee1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeu:q7Tc2NYHUrAwfMp3CDu
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral2/memory/1208-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/828-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2748-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/836-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1336-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1276-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3908-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2972-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/112-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/888-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3360-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3400-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3460-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-664-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-701-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-829-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-1309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/368-1554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 828 bbbbbb.exe 1076 nhhhbh.exe 400 thnhbb.exe 4416 xffflrr.exe 2748 btbbbh.exe 3720 nnnhhh.exe 3988 dpddd.exe 3712 hhnnbb.exe 1312 dpddd.exe 3600 jpddv.exe 536 hbbbbh.exe 1096 jjppp.exe 836 xllrrxf.exe 1336 lflrrxx.exe 4024 hbnttb.exe 2348 djvvv.exe 1276 fxfxxff.exe 2004 nntttb.exe 2016 vvddd.exe 1340 rfrrrxx.exe 4696 lxrllrx.exe 3688 jdjjj.exe 2940 1vdvv.exe 3248 rlxxxrr.exe 3908 xfllfrr.exe 3668 xrrlxxx.exe 1940 lrlxllx.exe 3252 xllxlfr.exe 2008 ddjdv.exe 5000 nbnnht.exe 3256 rlxrllr.exe 5112 nhnnhn.exe 2972 lffxrrr.exe 2868 btnhbb.exe 4620 vvdpj.exe 3648 fxxrrlf.exe 3292 tnhbbt.exe 112 bnhbtt.exe 888 3pppd.exe 4132 rllxlfx.exe 4176 hthbtn.exe 3360 pjjdv.exe 4320 vvdvj.exe 4388 xxlfrfx.exe 4156 bbbthh.exe 2296 vjjdp.exe 4664 pdjdp.exe 3424 xrlfrfx.exe 2284 hbhbtt.exe 1708 pdjjj.exe 1876 flrfrrf.exe 2832 hthbbb.exe 2432 3vddv.exe 3164 pddvv.exe 3560 frfxffl.exe 2684 httnnn.exe 1312 vvjdp.exe 2260 frxxrrf.exe 3400 llrrxll.exe 640 ntbtnh.exe 2212 vvjdd.exe 2324 fxxrrlf.exe 4556 lfrflrf.exe 2032 dvppj.exe -
resource yara_rule behavioral2/memory/1208-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/828-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2748-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1096-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/836-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1336-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1276-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2348-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3908-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2972-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/112-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/888-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3360-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3400-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3460-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-780-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-829-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-1212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-1309-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ntnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxflxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1208 wrote to memory of 828 1208 0b31919303b782dc458069a8d2d608240acae7f90ee71c7a2fe689e54373197b.exe 82 PID 1208 wrote to memory of 828 1208 0b31919303b782dc458069a8d2d608240acae7f90ee71c7a2fe689e54373197b.exe 82 PID 1208 wrote to memory of 828 1208 0b31919303b782dc458069a8d2d608240acae7f90ee71c7a2fe689e54373197b.exe 82 PID 828 wrote to memory of 1076 828 bbbbbb.exe 83 PID 828 wrote to memory of 1076 828 bbbbbb.exe 83 PID 828 wrote to memory of 1076 828 bbbbbb.exe 83 PID 1076 wrote to memory of 400 1076 nhhhbh.exe 84 PID 1076 wrote to memory of 400 1076 nhhhbh.exe 84 PID 1076 wrote to memory of 400 1076 nhhhbh.exe 84 PID 400 wrote to memory of 4416 400 thnhbb.exe 85 PID 400 wrote to memory of 4416 400 thnhbb.exe 85 PID 400 wrote to memory of 4416 400 thnhbb.exe 85 PID 4416 wrote to memory of 2748 4416 xffflrr.exe 86 PID 4416 wrote to memory of 2748 4416 xffflrr.exe 86 PID 4416 wrote to memory of 2748 4416 xffflrr.exe 86 PID 2748 wrote to memory of 3720 2748 btbbbh.exe 87 PID 2748 wrote to memory of 3720 2748 btbbbh.exe 87 PID 2748 wrote to memory of 3720 2748 btbbbh.exe 87 PID 3720 wrote to memory of 3988 3720 nnnhhh.exe 88 PID 3720 wrote to memory of 3988 3720 nnnhhh.exe 88 PID 3720 wrote to memory of 3988 3720 nnnhhh.exe 88 PID 3988 wrote to memory of 3712 3988 dpddd.exe 89 PID 3988 wrote to memory of 3712 3988 dpddd.exe 89 PID 3988 wrote to memory of 3712 3988 dpddd.exe 89 PID 3712 wrote to memory of 1312 3712 hhnnbb.exe 90 PID 3712 wrote to memory of 1312 3712 hhnnbb.exe 90 PID 3712 wrote to memory of 1312 3712 hhnnbb.exe 90 PID 1312 wrote to memory of 3600 1312 dpddd.exe 91 PID 1312 wrote to memory of 3600 1312 dpddd.exe 91 PID 1312 wrote to memory of 3600 1312 dpddd.exe 91 PID 3600 wrote to memory of 536 3600 jpddv.exe 92 PID 3600 wrote to memory of 536 3600 jpddv.exe 92 PID 3600 wrote to memory of 536 3600 jpddv.exe 92 PID 536 wrote to memory of 1096 536 hbbbbh.exe 93 PID 536 wrote to memory of 1096 536 hbbbbh.exe 93 PID 536 wrote to memory of 1096 536 hbbbbh.exe 93 PID 1096 wrote to memory of 836 1096 jjppp.exe 94 PID 1096 wrote to memory of 836 1096 jjppp.exe 94 PID 1096 wrote to memory of 836 1096 jjppp.exe 94 PID 836 wrote to memory of 1336 836 xllrrxf.exe 95 PID 836 wrote to memory of 1336 836 xllrrxf.exe 95 PID 836 wrote to memory of 1336 836 xllrrxf.exe 95 PID 1336 wrote to memory of 4024 1336 lflrrxx.exe 96 PID 1336 wrote to memory of 4024 1336 lflrrxx.exe 96 PID 1336 wrote to memory of 4024 1336 lflrrxx.exe 96 PID 4024 wrote to memory of 2348 4024 hbnttb.exe 97 PID 4024 wrote to memory of 2348 4024 hbnttb.exe 97 PID 4024 wrote to memory of 2348 4024 hbnttb.exe 97 PID 2348 wrote to memory of 1276 2348 djvvv.exe 98 PID 2348 wrote to memory of 1276 2348 djvvv.exe 98 PID 2348 wrote to memory of 1276 2348 djvvv.exe 98 PID 1276 wrote to memory of 2004 1276 fxfxxff.exe 99 PID 1276 wrote to memory of 2004 1276 fxfxxff.exe 99 PID 1276 wrote to memory of 2004 1276 fxfxxff.exe 99 PID 2004 wrote to memory of 2016 2004 nntttb.exe 100 PID 2004 wrote to memory of 2016 2004 nntttb.exe 100 PID 2004 wrote to memory of 2016 2004 nntttb.exe 100 PID 2016 wrote to memory of 1340 2016 vvddd.exe 101 PID 2016 wrote to memory of 1340 2016 vvddd.exe 101 PID 2016 wrote to memory of 1340 2016 vvddd.exe 101 PID 1340 wrote to memory of 4696 1340 rfrrrxx.exe 102 PID 1340 wrote to memory of 4696 1340 rfrrrxx.exe 102 PID 1340 wrote to memory of 4696 1340 rfrrrxx.exe 102 PID 4696 wrote to memory of 3688 4696 lxrllrx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b31919303b782dc458069a8d2d608240acae7f90ee71c7a2fe689e54373197b.exe"C:\Users\Admin\AppData\Local\Temp\0b31919303b782dc458069a8d2d608240acae7f90ee71c7a2fe689e54373197b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\bbbbbb.exec:\bbbbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\nhhhbh.exec:\nhhhbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\thnhbb.exec:\thnhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\xffflrr.exec:\xffflrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\btbbbh.exec:\btbbbh.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\nnnhhh.exec:\nnnhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\dpddd.exec:\dpddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\hhnnbb.exec:\hhnnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\dpddd.exec:\dpddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\jpddv.exec:\jpddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\hbbbbh.exec:\hbbbbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\jjppp.exec:\jjppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\xllrrxf.exec:\xllrrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\lflrrxx.exec:\lflrrxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\hbnttb.exec:\hbnttb.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\djvvv.exec:\djvvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\fxfxxff.exec:\fxfxxff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\nntttb.exec:\nntttb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\vvddd.exec:\vvddd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\rfrrrxx.exec:\rfrrrxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\lxrllrx.exec:\lxrllrx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\jdjjj.exec:\jdjjj.exe23⤵
- Executes dropped EXE
PID:3688 -
\??\c:\1vdvv.exec:\1vdvv.exe24⤵
- Executes dropped EXE
PID:2940 -
\??\c:\rlxxxrr.exec:\rlxxxrr.exe25⤵
- Executes dropped EXE
PID:3248 -
\??\c:\xfllfrr.exec:\xfllfrr.exe26⤵
- Executes dropped EXE
PID:3908 -
\??\c:\xrrlxxx.exec:\xrrlxxx.exe27⤵
- Executes dropped EXE
PID:3668 -
\??\c:\lrlxllx.exec:\lrlxllx.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1940 -
\??\c:\xllxlfr.exec:\xllxlfr.exe29⤵
- Executes dropped EXE
PID:3252 -
\??\c:\ddjdv.exec:\ddjdv.exe30⤵
- Executes dropped EXE
PID:2008 -
\??\c:\nbnnht.exec:\nbnnht.exe31⤵
- Executes dropped EXE
PID:5000 -
\??\c:\rlxrllr.exec:\rlxrllr.exe32⤵
- Executes dropped EXE
PID:3256 -
\??\c:\nhnnhn.exec:\nhnnhn.exe33⤵
- Executes dropped EXE
PID:5112 -
\??\c:\lffxrrr.exec:\lffxrrr.exe34⤵
- Executes dropped EXE
PID:2972 -
\??\c:\btnhbb.exec:\btnhbb.exe35⤵
- Executes dropped EXE
PID:2868 -
\??\c:\vvdpj.exec:\vvdpj.exe36⤵
- Executes dropped EXE
PID:4620 -
\??\c:\fxxrrlf.exec:\fxxrrlf.exe37⤵
- Executes dropped EXE
PID:3648 -
\??\c:\tnhbbt.exec:\tnhbbt.exe38⤵
- Executes dropped EXE
PID:3292 -
\??\c:\bnhbtt.exec:\bnhbtt.exe39⤵
- Executes dropped EXE
PID:112 -
\??\c:\3pppd.exec:\3pppd.exe40⤵
- Executes dropped EXE
PID:888 -
\??\c:\rllxlfx.exec:\rllxlfx.exe41⤵
- Executes dropped EXE
PID:4132 -
\??\c:\hthbtn.exec:\hthbtn.exe42⤵
- Executes dropped EXE
PID:4176 -
\??\c:\pjjdv.exec:\pjjdv.exe43⤵
- Executes dropped EXE
PID:3360 -
\??\c:\vvdvj.exec:\vvdvj.exe44⤵
- Executes dropped EXE
PID:4320 -
\??\c:\xxlfrfx.exec:\xxlfrfx.exe45⤵
- Executes dropped EXE
PID:4388 -
\??\c:\bbbthh.exec:\bbbthh.exe46⤵
- Executes dropped EXE
PID:4156 -
\??\c:\vjjdp.exec:\vjjdp.exe47⤵
- Executes dropped EXE
PID:2296 -
\??\c:\pdjdp.exec:\pdjdp.exe48⤵
- Executes dropped EXE
PID:4664 -
\??\c:\xrlfrfx.exec:\xrlfrfx.exe49⤵
- Executes dropped EXE
PID:3424 -
\??\c:\hbhbtt.exec:\hbhbtt.exe50⤵
- Executes dropped EXE
PID:2284 -
\??\c:\pdjjj.exec:\pdjjj.exe51⤵
- Executes dropped EXE
PID:1708 -
\??\c:\flrfrrf.exec:\flrfrrf.exe52⤵
- Executes dropped EXE
PID:1876 -
\??\c:\hthbbb.exec:\hthbbb.exe53⤵
- Executes dropped EXE
PID:2832 -
\??\c:\3vddv.exec:\3vddv.exe54⤵
- Executes dropped EXE
PID:2432 -
\??\c:\pddvv.exec:\pddvv.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3164 -
\??\c:\frfxffl.exec:\frfxffl.exe56⤵
- Executes dropped EXE
PID:3560 -
\??\c:\httnnn.exec:\httnnn.exe57⤵
- Executes dropped EXE
PID:2684 -
\??\c:\vvjdp.exec:\vvjdp.exe58⤵
- Executes dropped EXE
PID:1312 -
\??\c:\frxxrrf.exec:\frxxrrf.exe59⤵
- Executes dropped EXE
PID:2260 -
\??\c:\llrrxll.exec:\llrrxll.exe60⤵
- Executes dropped EXE
PID:3400 -
\??\c:\ntbtnh.exec:\ntbtnh.exe61⤵
- Executes dropped EXE
PID:640 -
\??\c:\vvjdd.exec:\vvjdd.exe62⤵
- Executes dropped EXE
PID:2212 -
\??\c:\fxxrrlf.exec:\fxxrrlf.exe63⤵
- Executes dropped EXE
PID:2324 -
\??\c:\lfrflrf.exec:\lfrflrf.exe64⤵
- Executes dropped EXE
PID:4556 -
\??\c:\dvppj.exec:\dvppj.exe65⤵
- Executes dropped EXE
PID:2032 -
\??\c:\vjpjd.exec:\vjpjd.exe66⤵PID:3012
-
\??\c:\rrrlffx.exec:\rrrlffx.exe67⤵PID:232
-
\??\c:\tthbnh.exec:\tthbnh.exe68⤵PID:2236
-
\??\c:\vpvvd.exec:\vpvvd.exe69⤵PID:1552
-
\??\c:\rfrffff.exec:\rfrffff.exe70⤵PID:3608
-
\??\c:\nnnbnt.exec:\nnnbnt.exe71⤵PID:1296
-
\??\c:\hnttnn.exec:\hnttnn.exe72⤵PID:5036
-
\??\c:\vdjvp.exec:\vdjvp.exe73⤵PID:3268
-
\??\c:\rllfrll.exec:\rllfrll.exe74⤵PID:4968
-
\??\c:\5nhbtn.exec:\5nhbtn.exe75⤵PID:3444
-
\??\c:\7bbtnn.exec:\7bbtnn.exe76⤵PID:3680
-
\??\c:\7vpvp.exec:\7vpvp.exe77⤵PID:4064
-
\??\c:\rxrrlfx.exec:\rxrrlfx.exe78⤵PID:1504
-
\??\c:\tnbhth.exec:\tnbhth.exe79⤵PID:2920
-
\??\c:\vdjjv.exec:\vdjjv.exe80⤵PID:1944
-
\??\c:\pjvpj.exec:\pjvpj.exe81⤵PID:3084
-
\??\c:\rrxxrff.exec:\rrxxrff.exe82⤵PID:3908
-
\??\c:\nhhhbb.exec:\nhhhbb.exe83⤵PID:1260
-
\??\c:\jvjjj.exec:\jvjjj.exe84⤵PID:1228
-
\??\c:\flfxrrf.exec:\flfxrrf.exe85⤵PID:5056
-
\??\c:\lxfrllx.exec:\lxfrllx.exe86⤵PID:3252
-
\??\c:\hthbbt.exec:\hthbbt.exe87⤵PID:3456
-
\??\c:\jdvpp.exec:\jdvpp.exe88⤵PID:212
-
\??\c:\xfffllf.exec:\xfffllf.exe89⤵PID:3132
-
\??\c:\rfllfxl.exec:\rfllfxl.exe90⤵PID:3256
-
\??\c:\bnbthh.exec:\bnbthh.exe91⤵PID:3528
-
\??\c:\vjvvv.exec:\vjvvv.exe92⤵PID:5112
-
\??\c:\fllfxrl.exec:\fllfxrl.exe93⤵PID:2972
-
\??\c:\tnnnhb.exec:\tnnnhb.exe94⤵PID:4472
-
\??\c:\dvpjp.exec:\dvpjp.exe95⤵PID:4620
-
\??\c:\vpdvd.exec:\vpdvd.exe96⤵PID:3648
-
\??\c:\1flfrfx.exec:\1flfrfx.exe97⤵PID:3292
-
\??\c:\ntbbnn.exec:\ntbbnn.exe98⤵PID:376
-
\??\c:\1jddp.exec:\1jddp.exe99⤵PID:4160
-
\??\c:\pddpj.exec:\pddpj.exe100⤵PID:4616
-
\??\c:\nbbnhb.exec:\nbbnhb.exe101⤵PID:548
-
\??\c:\dvvpj.exec:\dvvpj.exe102⤵PID:4044
-
\??\c:\xxfrllf.exec:\xxfrllf.exe103⤵PID:636
-
\??\c:\rlxrrlr.exec:\rlxrrlr.exe104⤵PID:1268
-
\??\c:\nhttnh.exec:\nhttnh.exe105⤵PID:4632
-
\??\c:\1jjjv.exec:\1jjjv.exe106⤵PID:3140
-
\??\c:\vdddp.exec:\vdddp.exe107⤵PID:4996
-
\??\c:\1fflxfx.exec:\1fflxfx.exe108⤵PID:2444
-
\??\c:\hhbttt.exec:\hhbttt.exe109⤵PID:1068
-
\??\c:\vjvpj.exec:\vjvpj.exe110⤵PID:4352
-
\??\c:\djpjd.exec:\djpjd.exe111⤵PID:3392
-
\??\c:\lffxrxr.exec:\lffxrxr.exe112⤵PID:4708
-
\??\c:\bbnnnn.exec:\bbnnnn.exe113⤵PID:4200
-
\??\c:\ntttnn.exec:\ntttnn.exe114⤵PID:4008
-
\??\c:\5vvjd.exec:\5vvjd.exe115⤵PID:3772
-
\??\c:\tnnnhh.exec:\tnnnhh.exe116⤵PID:2748
-
\??\c:\bbtbnh.exec:\bbtbnh.exe117⤵PID:2488
-
\??\c:\vvvpj.exec:\vvvpj.exe118⤵PID:2432
-
\??\c:\fllxrlf.exec:\fllxrlf.exe119⤵PID:3988
-
\??\c:\htbtnh.exec:\htbtnh.exe120⤵PID:4220
-
\??\c:\tnhbtt.exec:\tnhbtt.exe121⤵PID:1484
-
\??\c:\ddvvj.exec:\ddvvj.exe122⤵PID:4448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-