Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dd91b65c1359ec67db53b7265aa436e023d7beba502e3456ed9ec8ef6997c6c5N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
dd91b65c1359ec67db53b7265aa436e023d7beba502e3456ed9ec8ef6997c6c5N.exe
-
Size
455KB
-
MD5
d098b70a675ba23a54040ba152404f20
-
SHA1
c1c950a3fbab4f64d305730e0e18cf0de1702bec
-
SHA256
dd91b65c1359ec67db53b7265aa436e023d7beba502e3456ed9ec8ef6997c6c5
-
SHA512
d2a1c6f76b8243768aeca323af6baa471c7e048ada930528e4710bbb595832714948cb63cf6e9d915fa1799cce6ea44c571f908fd966ebe755a9d96ab9fedfa4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeg:q7Tc2NYHUrAwfMp3CDg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1256-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3348-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/516-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2000-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2340-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2988-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1940-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/880-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2956-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3792-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1212-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/816-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2392-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/320-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2772-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2376-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/892-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/668-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2340-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-690-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3380-694-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-779-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2560-1222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1256 bntnbh.exe 1728 hbhtnt.exe 4560 vjddd.exe 4352 xfxfffr.exe 2840 rllllff.exe 2904 frrrrlx.exe 4132 djdvp.exe 4824 ffrxrrl.exe 3348 7pjvv.exe 516 lrrlxxr.exe 2000 flxxxxx.exe 3212 btbbbb.exe 3512 pvvpj.exe 2676 lfrxrff.exe 4012 lxfxllr.exe 2560 tbtbnt.exe 4528 nntttt.exe 4648 rxxrrrf.exe 1516 bntnnn.exe 2328 frfflll.exe 392 tbttnn.exe 5092 flllrxx.exe 2324 ddjpv.exe 2340 thbbbh.exe 3156 9vvvj.exe 2988 rxfxxxx.exe 880 pvvjj.exe 1940 9fllffx.exe 4968 lxrrlxr.exe 2956 jdvdd.exe 1608 flfxffx.exe 1732 nhtttb.exe 3792 9djpj.exe 1996 bhbnbh.exe 2252 vvddp.exe 4712 3xlxlxl.exe 812 7ddpp.exe 2092 rxrllff.exe 4472 1nnhbb.exe 4580 ddvvp.exe 1212 1ffffxx.exe 3972 5pvvv.exe 636 fllfrrf.exe 1888 hbhhnt.exe 3940 jjjjj.exe 4876 rfxrllf.exe 816 nhhhbb.exe 4540 bhhhnn.exe 4404 xlxlrfr.exe 4784 7bbbbb.exe 2660 vjdjd.exe 4340 xflxxfl.exe 4988 tbbbtt.exe 4940 5dppp.exe 4880 ffrfrxl.exe 2392 bthtth.exe 780 7ppdv.exe 320 rxxxrrr.exe 4388 7xrrllf.exe 1056 1djdv.exe 4132 pdvvd.exe 3408 rffllrf.exe 1476 7bttnn.exe 3868 dpvpp.exe -
resource yara_rule behavioral2/memory/1256-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3348-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/516-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2000-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2328-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2340-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2988-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1940-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/880-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2956-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3792-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1212-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1888-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/816-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2392-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/320-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2772-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/892-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/668-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2340-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3380-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-779-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2932 wrote to memory of 1256 2932 dd91b65c1359ec67db53b7265aa436e023d7beba502e3456ed9ec8ef6997c6c5N.exe 83 PID 2932 wrote to memory of 1256 2932 dd91b65c1359ec67db53b7265aa436e023d7beba502e3456ed9ec8ef6997c6c5N.exe 83 PID 2932 wrote to memory of 1256 2932 dd91b65c1359ec67db53b7265aa436e023d7beba502e3456ed9ec8ef6997c6c5N.exe 83 PID 1256 wrote to memory of 1728 1256 bntnbh.exe 84 PID 1256 wrote to memory of 1728 1256 bntnbh.exe 84 PID 1256 wrote to memory of 1728 1256 bntnbh.exe 84 PID 1728 wrote to memory of 4560 1728 hbhtnt.exe 85 PID 1728 wrote to memory of 4560 1728 hbhtnt.exe 85 PID 1728 wrote to memory of 4560 1728 hbhtnt.exe 85 PID 4560 wrote to memory of 4352 4560 vjddd.exe 86 PID 4560 wrote to memory of 4352 4560 vjddd.exe 86 PID 4560 wrote to memory of 4352 4560 vjddd.exe 86 PID 4352 wrote to memory of 2840 4352 xfxfffr.exe 87 PID 4352 wrote to memory of 2840 4352 xfxfffr.exe 87 PID 4352 wrote to memory of 2840 4352 xfxfffr.exe 87 PID 2840 wrote to memory of 2904 2840 rllllff.exe 88 PID 2840 wrote to memory of 2904 2840 rllllff.exe 88 PID 2840 wrote to memory of 2904 2840 rllllff.exe 88 PID 2904 wrote to memory of 4132 2904 frrrrlx.exe 89 PID 2904 wrote to memory of 4132 2904 frrrrlx.exe 89 PID 2904 wrote to memory of 4132 2904 frrrrlx.exe 89 PID 4132 wrote to memory of 4824 4132 djdvp.exe 90 PID 4132 wrote to memory of 4824 4132 djdvp.exe 90 PID 4132 wrote to memory of 4824 4132 djdvp.exe 90 PID 4824 wrote to memory of 3348 4824 ffrxrrl.exe 91 PID 4824 wrote to memory of 3348 4824 ffrxrrl.exe 91 PID 4824 wrote to memory of 3348 4824 ffrxrrl.exe 91 PID 3348 wrote to memory of 516 3348 7pjvv.exe 92 PID 3348 wrote to memory of 516 3348 7pjvv.exe 92 PID 3348 wrote to memory of 516 3348 7pjvv.exe 92 PID 516 wrote to memory of 2000 516 lrrlxxr.exe 93 PID 516 wrote to memory of 2000 516 lrrlxxr.exe 93 PID 516 wrote to memory of 2000 516 lrrlxxr.exe 93 PID 2000 wrote to memory of 3212 2000 flxxxxx.exe 94 PID 2000 wrote to memory of 3212 2000 flxxxxx.exe 94 PID 2000 wrote to memory of 3212 2000 flxxxxx.exe 94 PID 3212 wrote to memory of 3512 3212 btbbbb.exe 95 PID 3212 wrote to memory of 3512 3212 btbbbb.exe 95 PID 3212 wrote to memory of 3512 3212 btbbbb.exe 95 PID 3512 wrote to memory of 2676 3512 pvvpj.exe 96 PID 3512 wrote to memory of 2676 3512 pvvpj.exe 96 PID 3512 wrote to memory of 2676 3512 pvvpj.exe 96 PID 2676 wrote to memory of 4012 2676 lfrxrff.exe 97 PID 2676 wrote to memory of 4012 2676 lfrxrff.exe 97 PID 2676 wrote to memory of 4012 2676 lfrxrff.exe 97 PID 4012 wrote to memory of 2560 4012 lxfxllr.exe 98 PID 4012 wrote to memory of 2560 4012 lxfxllr.exe 98 PID 4012 wrote to memory of 2560 4012 lxfxllr.exe 98 PID 2560 wrote to memory of 4528 2560 tbtbnt.exe 99 PID 2560 wrote to memory of 4528 2560 tbtbnt.exe 99 PID 2560 wrote to memory of 4528 2560 tbtbnt.exe 99 PID 4528 wrote to memory of 4648 4528 nntttt.exe 100 PID 4528 wrote to memory of 4648 4528 nntttt.exe 100 PID 4528 wrote to memory of 4648 4528 nntttt.exe 100 PID 4648 wrote to memory of 1516 4648 rxxrrrf.exe 101 PID 4648 wrote to memory of 1516 4648 rxxrrrf.exe 101 PID 4648 wrote to memory of 1516 4648 rxxrrrf.exe 101 PID 1516 wrote to memory of 2328 1516 bntnnn.exe 102 PID 1516 wrote to memory of 2328 1516 bntnnn.exe 102 PID 1516 wrote to memory of 2328 1516 bntnnn.exe 102 PID 2328 wrote to memory of 392 2328 frfflll.exe 103 PID 2328 wrote to memory of 392 2328 frfflll.exe 103 PID 2328 wrote to memory of 392 2328 frfflll.exe 103 PID 392 wrote to memory of 5092 392 tbttnn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd91b65c1359ec67db53b7265aa436e023d7beba502e3456ed9ec8ef6997c6c5N.exe"C:\Users\Admin\AppData\Local\Temp\dd91b65c1359ec67db53b7265aa436e023d7beba502e3456ed9ec8ef6997c6c5N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\bntnbh.exec:\bntnbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\hbhtnt.exec:\hbhtnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\vjddd.exec:\vjddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\xfxfffr.exec:\xfxfffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\rllllff.exec:\rllllff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\frrrrlx.exec:\frrrrlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\djdvp.exec:\djdvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\ffrxrrl.exec:\ffrxrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\7pjvv.exec:\7pjvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\lrrlxxr.exec:\lrrlxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\flxxxxx.exec:\flxxxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\btbbbb.exec:\btbbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\pvvpj.exec:\pvvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\lfrxrff.exec:\lfrxrff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\lxfxllr.exec:\lxfxllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\tbtbnt.exec:\tbtbnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\nntttt.exec:\nntttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\rxxrrrf.exec:\rxxrrrf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\bntnnn.exec:\bntnnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\frfflll.exec:\frfflll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\tbttnn.exec:\tbttnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\flllrxx.exec:\flllrxx.exe23⤵
- Executes dropped EXE
PID:5092 -
\??\c:\ddjpv.exec:\ddjpv.exe24⤵
- Executes dropped EXE
PID:2324 -
\??\c:\thbbbh.exec:\thbbbh.exe25⤵
- Executes dropped EXE
PID:2340 -
\??\c:\9vvvj.exec:\9vvvj.exe26⤵
- Executes dropped EXE
PID:3156 -
\??\c:\rxfxxxx.exec:\rxfxxxx.exe27⤵
- Executes dropped EXE
PID:2988 -
\??\c:\pvvjj.exec:\pvvjj.exe28⤵
- Executes dropped EXE
PID:880 -
\??\c:\9fllffx.exec:\9fllffx.exe29⤵
- Executes dropped EXE
PID:1940 -
\??\c:\lxrrlxr.exec:\lxrrlxr.exe30⤵
- Executes dropped EXE
PID:4968 -
\??\c:\jdvdd.exec:\jdvdd.exe31⤵
- Executes dropped EXE
PID:2956 -
\??\c:\flfxffx.exec:\flfxffx.exe32⤵
- Executes dropped EXE
PID:1608 -
\??\c:\nhtttb.exec:\nhtttb.exe33⤵
- Executes dropped EXE
PID:1732 -
\??\c:\9djpj.exec:\9djpj.exe34⤵
- Executes dropped EXE
PID:3792 -
\??\c:\bhbnbh.exec:\bhbnbh.exe35⤵
- Executes dropped EXE
PID:1996 -
\??\c:\vvddp.exec:\vvddp.exe36⤵
- Executes dropped EXE
PID:2252 -
\??\c:\3xlxlxl.exec:\3xlxlxl.exe37⤵
- Executes dropped EXE
PID:4712 -
\??\c:\7ddpp.exec:\7ddpp.exe38⤵
- Executes dropped EXE
PID:812 -
\??\c:\rxrllff.exec:\rxrllff.exe39⤵
- Executes dropped EXE
PID:2092 -
\??\c:\1nnhbb.exec:\1nnhbb.exe40⤵
- Executes dropped EXE
PID:4472 -
\??\c:\ddvvp.exec:\ddvvp.exe41⤵
- Executes dropped EXE
PID:4580 -
\??\c:\1ffffxx.exec:\1ffffxx.exe42⤵
- Executes dropped EXE
PID:1212 -
\??\c:\5pvvv.exec:\5pvvv.exe43⤵
- Executes dropped EXE
PID:3972 -
\??\c:\fllfrrf.exec:\fllfrrf.exe44⤵
- Executes dropped EXE
PID:636 -
\??\c:\hbhhnt.exec:\hbhhnt.exe45⤵
- Executes dropped EXE
PID:1888 -
\??\c:\jjjjj.exec:\jjjjj.exe46⤵
- Executes dropped EXE
PID:3940 -
\??\c:\rfxrllf.exec:\rfxrllf.exe47⤵
- Executes dropped EXE
PID:4876 -
\??\c:\nhhhbb.exec:\nhhhbb.exe48⤵
- Executes dropped EXE
PID:816 -
\??\c:\bhhhnn.exec:\bhhhnn.exe49⤵
- Executes dropped EXE
PID:4540 -
\??\c:\xlxlrfr.exec:\xlxlrfr.exe50⤵
- Executes dropped EXE
PID:4404 -
\??\c:\7bbbbb.exec:\7bbbbb.exe51⤵
- Executes dropped EXE
PID:4784 -
\??\c:\vjdjd.exec:\vjdjd.exe52⤵
- Executes dropped EXE
PID:2660 -
\??\c:\xflxxfl.exec:\xflxxfl.exe53⤵
- Executes dropped EXE
PID:4340 -
\??\c:\tbbbtt.exec:\tbbbtt.exe54⤵
- Executes dropped EXE
PID:4988 -
\??\c:\5dppp.exec:\5dppp.exe55⤵
- Executes dropped EXE
PID:4940 -
\??\c:\ffrfrxl.exec:\ffrfrxl.exe56⤵
- Executes dropped EXE
PID:4880 -
\??\c:\bthtth.exec:\bthtth.exe57⤵
- Executes dropped EXE
PID:2392 -
\??\c:\7ppdv.exec:\7ppdv.exe58⤵
- Executes dropped EXE
PID:780 -
\??\c:\rxxxrrr.exec:\rxxxrrr.exe59⤵
- Executes dropped EXE
PID:320 -
\??\c:\7xrrllf.exec:\7xrrllf.exe60⤵
- Executes dropped EXE
PID:4388 -
\??\c:\1djdv.exec:\1djdv.exe61⤵
- Executes dropped EXE
PID:1056 -
\??\c:\pdvvd.exec:\pdvvd.exe62⤵
- Executes dropped EXE
PID:4132 -
\??\c:\rffllrf.exec:\rffllrf.exe63⤵
- Executes dropped EXE
PID:3408 -
\??\c:\7bttnn.exec:\7bttnn.exe64⤵
- Executes dropped EXE
PID:1476 -
\??\c:\dpvpp.exec:\dpvpp.exe65⤵
- Executes dropped EXE
PID:3868 -
\??\c:\5lfllrx.exec:\5lfllrx.exe66⤵PID:2632
-
\??\c:\xlxffff.exec:\xlxffff.exe67⤵PID:4652
-
\??\c:\bhnhtb.exec:\bhnhtb.exe68⤵PID:3620
-
\??\c:\1jjdv.exec:\1jjdv.exe69⤵PID:3304
-
\??\c:\rrfllrx.exec:\rrfllrx.exe70⤵PID:4524
-
\??\c:\5hhbnn.exec:\5hhbnn.exe71⤵PID:2832
-
\??\c:\vjddv.exec:\vjddv.exe72⤵PID:3580
-
\??\c:\lffrlxx.exec:\lffrlxx.exe73⤵PID:1468
-
\??\c:\hbbbtt.exec:\hbbbtt.exe74⤵PID:3920
-
\??\c:\3ppjd.exec:\3ppjd.exe75⤵PID:2772
-
\??\c:\flfrlfr.exec:\flfrlfr.exe76⤵PID:4648
-
\??\c:\dddpp.exec:\dddpp.exe77⤵PID:4148
-
\??\c:\flrlffx.exec:\flrlffx.exe78⤵PID:1516
-
\??\c:\thtnnn.exec:\thtnnn.exe79⤵PID:388
-
\??\c:\vjppd.exec:\vjppd.exe80⤵PID:1708
-
\??\c:\pvvvd.exec:\pvvvd.exe81⤵PID:2376
-
\??\c:\tbbttt.exec:\tbbttt.exe82⤵PID:4152
-
\??\c:\jvppd.exec:\jvppd.exe83⤵PID:5016
-
\??\c:\jjjpp.exec:\jjjpp.exe84⤵PID:4504
-
\??\c:\xlrrllr.exec:\xlrrllr.exe85⤵PID:3812
-
\??\c:\9htnnt.exec:\9htnnt.exe86⤵PID:1060
-
\??\c:\nnnnnt.exec:\nnnnnt.exe87⤵PID:3288
-
\??\c:\jjddd.exec:\jjddd.exe88⤵PID:3428
-
\??\c:\xflllrr.exec:\xflllrr.exe89⤵PID:892
-
\??\c:\hbtnnb.exec:\hbtnnb.exe90⤵PID:1940
-
\??\c:\ppjjj.exec:\ppjjj.exe91⤵PID:4392
-
\??\c:\vvpvv.exec:\vvpvv.exe92⤵PID:1632
-
\??\c:\1xfxflr.exec:\1xfxflr.exe93⤵PID:2480
-
\??\c:\bhbbhn.exec:\bhbbhn.exe94⤵PID:1732
-
\??\c:\1djpv.exec:\1djpv.exe95⤵PID:3536
-
\??\c:\vdppp.exec:\vdppp.exe96⤵PID:452
-
\??\c:\rrfflll.exec:\rrfflll.exe97⤵PID:2104
-
\??\c:\3nnhhh.exec:\3nnhhh.exe98⤵PID:1032
-
\??\c:\1vppp.exec:\1vppp.exe99⤵PID:4712
-
\??\c:\fxxxffl.exec:\fxxxffl.exe100⤵PID:812
-
\??\c:\rxxxrrr.exec:\rxxxrrr.exe101⤵PID:2448
-
\??\c:\nttbbb.exec:\nttbbb.exe102⤵PID:3616
-
\??\c:\hnhnhn.exec:\hnhnhn.exe103⤵PID:4400
-
\??\c:\jpjjd.exec:\jpjjd.exe104⤵PID:1588
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe105⤵PID:3528
-
\??\c:\bnbtnn.exec:\bnbtnn.exe106⤵PID:1020
-
\??\c:\pdddp.exec:\pdddp.exe107⤵PID:668
-
\??\c:\xllffff.exec:\xllffff.exe108⤵PID:1820
-
\??\c:\hnbbhn.exec:\hnbbhn.exe109⤵PID:2800
-
\??\c:\jvdjp.exec:\jvdjp.exe110⤵PID:1340
-
\??\c:\djjjd.exec:\djjjd.exe111⤵PID:4300
-
\??\c:\llllrrr.exec:\llllrrr.exe112⤵
- System Location Discovery: System Language Discovery
PID:776 -
\??\c:\thhhnn.exec:\thhhnn.exe113⤵PID:1260
-
\??\c:\djvjj.exec:\djvjj.exe114⤵PID:4484
-
\??\c:\xrfflll.exec:\xrfflll.exe115⤵PID:4992
-
\??\c:\hntbbn.exec:\hntbbn.exe116⤵PID:5096
-
\??\c:\vddjj.exec:\vddjj.exe117⤵PID:3736
-
\??\c:\xfrrlfx.exec:\xfrrlfx.exe118⤵PID:3856
-
\??\c:\hhnhnn.exec:\hhnhnn.exe119⤵PID:3668
-
\??\c:\dvvvd.exec:\dvvvd.exe120⤵PID:4704
-
\??\c:\vdpjp.exec:\vdpjp.exe121⤵PID:4884
-
\??\c:\llrrxxx.exec:\llrrxxx.exe122⤵PID:2904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-