Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
18-02-2025 07:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f035841bd7cbe1352c035b4983dd6122e28b3752df6916f744d03afb5f0a96e5.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
f035841bd7cbe1352c035b4983dd6122e28b3752df6916f744d03afb5f0a96e5.exe
-
Size
456KB
-
MD5
3c609f47a1ff69c76a533502ad32b5ae
-
SHA1
d83bf3e01a72793f95f50fda4d0272819fb58d94
-
SHA256
f035841bd7cbe1352c035b4983dd6122e28b3752df6916f744d03afb5f0a96e5
-
SHA512
abeb47ccd62fc3328434dc7124f5ea6497606575fa2edfbc150beaeaf5ac2848254951b72037c36261fd39e46acce8755fd4850d911b402b0e6a2b12be3210f3
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeW:q7Tc2NYHUrAwfMp3CDW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4904-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1292-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1060-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/644-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3296-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1084-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3812-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/952-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2700-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4244-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/808-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2584-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3388-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-793-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3728-854-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1536-1151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4976 1vdpp.exe 3184 hnhthb.exe 2080 nbnbnh.exe 2708 dppjv.exe 1124 5bbnhh.exe 3712 3lfrfxf.exe 5016 5vjvv.exe 4072 btthtn.exe 1292 lfrlxlf.exe 1060 nbhtth.exe 4204 vppdp.exe 4596 rxxrrfx.exe 1224 9bnhtn.exe 2912 9tnbnh.exe 3604 hbtbtn.exe 1304 vppjd.exe 2176 frrfxrf.exe 4408 hthnbt.exe 4848 hbthth.exe 4268 bhnbnh.exe 4748 5dvjv.exe 1284 7jjvj.exe 644 fxlfrfr.exe 3728 xxxlxlf.exe 404 1nbthb.exe 400 djpjd.exe 5020 5rrrrlf.exe 3296 3ddpd.exe 3008 5xrxrlx.exe 868 ddvjd.exe 4024 3nnhbt.exe 3420 5vvdp.exe 2396 nhhtbn.exe 2720 vvjdv.exe 2412 1xrlfxx.exe 1792 nnbhhb.exe 3456 jpdpp.exe 964 rfflxrf.exe 5044 tbbhtn.exe 2008 3jjjd.exe 4212 frlxlxf.exe 4568 hbhtnb.exe 1084 dvpdp.exe 1848 lxffrfr.exe 2284 9bbnbb.exe 3836 dppdv.exe 4532 rxrfrfx.exe 3984 1lxrlxr.exe 4720 3bhbbb.exe 792 jvjjv.exe 4152 1fxrrrf.exe 4792 nbbnbn.exe 4312 dddpd.exe 4320 lflfrrx.exe 3744 fxxrllf.exe 2444 tthbtb.exe 2448 vppjd.exe 3180 jdjdd.exe 3812 lrxrffx.exe 5092 bnhtnb.exe 4656 9jjdv.exe 5072 lxxfrlx.exe 3232 nbhthh.exe 4876 dvvvv.exe -
resource yara_rule behavioral2/memory/4904-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1124-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1292-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1060-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/644-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1084-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/952-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4244-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/808-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2584-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3388-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-793-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rrfxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlxlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4904 wrote to memory of 4976 4904 f035841bd7cbe1352c035b4983dd6122e28b3752df6916f744d03afb5f0a96e5.exe 80 PID 4904 wrote to memory of 4976 4904 f035841bd7cbe1352c035b4983dd6122e28b3752df6916f744d03afb5f0a96e5.exe 80 PID 4904 wrote to memory of 4976 4904 f035841bd7cbe1352c035b4983dd6122e28b3752df6916f744d03afb5f0a96e5.exe 80 PID 4976 wrote to memory of 3184 4976 1vdpp.exe 81 PID 4976 wrote to memory of 3184 4976 1vdpp.exe 81 PID 4976 wrote to memory of 3184 4976 1vdpp.exe 81 PID 3184 wrote to memory of 2080 3184 hnhthb.exe 82 PID 3184 wrote to memory of 2080 3184 hnhthb.exe 82 PID 3184 wrote to memory of 2080 3184 hnhthb.exe 82 PID 2080 wrote to memory of 2708 2080 nbnbnh.exe 83 PID 2080 wrote to memory of 2708 2080 nbnbnh.exe 83 PID 2080 wrote to memory of 2708 2080 nbnbnh.exe 83 PID 2708 wrote to memory of 1124 2708 dppjv.exe 84 PID 2708 wrote to memory of 1124 2708 dppjv.exe 84 PID 2708 wrote to memory of 1124 2708 dppjv.exe 84 PID 1124 wrote to memory of 3712 1124 5bbnhh.exe 85 PID 1124 wrote to memory of 3712 1124 5bbnhh.exe 85 PID 1124 wrote to memory of 3712 1124 5bbnhh.exe 85 PID 3712 wrote to memory of 5016 3712 3lfrfxf.exe 86 PID 3712 wrote to memory of 5016 3712 3lfrfxf.exe 86 PID 3712 wrote to memory of 5016 3712 3lfrfxf.exe 86 PID 5016 wrote to memory of 4072 5016 5vjvv.exe 87 PID 5016 wrote to memory of 4072 5016 5vjvv.exe 87 PID 5016 wrote to memory of 4072 5016 5vjvv.exe 87 PID 4072 wrote to memory of 1292 4072 btthtn.exe 88 PID 4072 wrote to memory of 1292 4072 btthtn.exe 88 PID 4072 wrote to memory of 1292 4072 btthtn.exe 88 PID 1292 wrote to memory of 1060 1292 lfrlxlf.exe 89 PID 1292 wrote to memory of 1060 1292 lfrlxlf.exe 89 PID 1292 wrote to memory of 1060 1292 lfrlxlf.exe 89 PID 1060 wrote to memory of 4204 1060 nbhtth.exe 90 PID 1060 wrote to memory of 4204 1060 nbhtth.exe 90 PID 1060 wrote to memory of 4204 1060 nbhtth.exe 90 PID 4204 wrote to memory of 4596 4204 vppdp.exe 91 PID 4204 wrote to memory of 4596 4204 vppdp.exe 91 PID 4204 wrote to memory of 4596 4204 vppdp.exe 91 PID 4596 wrote to memory of 1224 4596 rxxrrfx.exe 92 PID 4596 wrote to memory of 1224 4596 rxxrrfx.exe 92 PID 4596 wrote to memory of 1224 4596 rxxrrfx.exe 92 PID 1224 wrote to memory of 2912 1224 9bnhtn.exe 93 PID 1224 wrote to memory of 2912 1224 9bnhtn.exe 93 PID 1224 wrote to memory of 2912 1224 9bnhtn.exe 93 PID 2912 wrote to memory of 3604 2912 9tnbnh.exe 94 PID 2912 wrote to memory of 3604 2912 9tnbnh.exe 94 PID 2912 wrote to memory of 3604 2912 9tnbnh.exe 94 PID 3604 wrote to memory of 1304 3604 hbtbtn.exe 95 PID 3604 wrote to memory of 1304 3604 hbtbtn.exe 95 PID 3604 wrote to memory of 1304 3604 hbtbtn.exe 95 PID 1304 wrote to memory of 2176 1304 vppjd.exe 96 PID 1304 wrote to memory of 2176 1304 vppjd.exe 96 PID 1304 wrote to memory of 2176 1304 vppjd.exe 96 PID 2176 wrote to memory of 4408 2176 frrfxrf.exe 97 PID 2176 wrote to memory of 4408 2176 frrfxrf.exe 97 PID 2176 wrote to memory of 4408 2176 frrfxrf.exe 97 PID 4408 wrote to memory of 4848 4408 hthnbt.exe 98 PID 4408 wrote to memory of 4848 4408 hthnbt.exe 98 PID 4408 wrote to memory of 4848 4408 hthnbt.exe 98 PID 4848 wrote to memory of 4268 4848 hbthth.exe 99 PID 4848 wrote to memory of 4268 4848 hbthth.exe 99 PID 4848 wrote to memory of 4268 4848 hbthth.exe 99 PID 4268 wrote to memory of 4748 4268 bhnbnh.exe 100 PID 4268 wrote to memory of 4748 4268 bhnbnh.exe 100 PID 4268 wrote to memory of 4748 4268 bhnbnh.exe 100 PID 4748 wrote to memory of 1284 4748 5dvjv.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\f035841bd7cbe1352c035b4983dd6122e28b3752df6916f744d03afb5f0a96e5.exe"C:\Users\Admin\AppData\Local\Temp\f035841bd7cbe1352c035b4983dd6122e28b3752df6916f744d03afb5f0a96e5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\1vdpp.exec:\1vdpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\hnhthb.exec:\hnhthb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\nbnbnh.exec:\nbnbnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\dppjv.exec:\dppjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\5bbnhh.exec:\5bbnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\3lfrfxf.exec:\3lfrfxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\5vjvv.exec:\5vjvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\btthtn.exec:\btthtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\lfrlxlf.exec:\lfrlxlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\nbhtth.exec:\nbhtth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\vppdp.exec:\vppdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\rxxrrfx.exec:\rxxrrfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\9bnhtn.exec:\9bnhtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\9tnbnh.exec:\9tnbnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\hbtbtn.exec:\hbtbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\vppjd.exec:\vppjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\frrfxrf.exec:\frrfxrf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\hthnbt.exec:\hthnbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\hbthth.exec:\hbthth.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\bhnbnh.exec:\bhnbnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\5dvjv.exec:\5dvjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\7jjvj.exec:\7jjvj.exe23⤵
- Executes dropped EXE
PID:1284 -
\??\c:\fxlfrfr.exec:\fxlfrfr.exe24⤵
- Executes dropped EXE
PID:644 -
\??\c:\xxxlxlf.exec:\xxxlxlf.exe25⤵
- Executes dropped EXE
PID:3728 -
\??\c:\1nbthb.exec:\1nbthb.exe26⤵
- Executes dropped EXE
PID:404 -
\??\c:\djpjd.exec:\djpjd.exe27⤵
- Executes dropped EXE
PID:400 -
\??\c:\5rrrrlf.exec:\5rrrrlf.exe28⤵
- Executes dropped EXE
PID:5020 -
\??\c:\3ddpd.exec:\3ddpd.exe29⤵
- Executes dropped EXE
PID:3296 -
\??\c:\5xrxrlx.exec:\5xrxrlx.exe30⤵
- Executes dropped EXE
PID:3008 -
\??\c:\ddvjd.exec:\ddvjd.exe31⤵
- Executes dropped EXE
PID:868 -
\??\c:\3nnhbt.exec:\3nnhbt.exe32⤵
- Executes dropped EXE
PID:4024 -
\??\c:\5vvdp.exec:\5vvdp.exe33⤵
- Executes dropped EXE
PID:3420 -
\??\c:\nhhtbn.exec:\nhhtbn.exe34⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vvjdv.exec:\vvjdv.exe35⤵
- Executes dropped EXE
PID:2720 -
\??\c:\1xrlfxx.exec:\1xrlfxx.exe36⤵
- Executes dropped EXE
PID:2412 -
\??\c:\nnbhhb.exec:\nnbhhb.exe37⤵
- Executes dropped EXE
PID:1792 -
\??\c:\jpdpp.exec:\jpdpp.exe38⤵
- Executes dropped EXE
PID:3456 -
\??\c:\rfflxrf.exec:\rfflxrf.exe39⤵
- Executes dropped EXE
PID:964 -
\??\c:\tbbhtn.exec:\tbbhtn.exe40⤵
- Executes dropped EXE
PID:5044 -
\??\c:\3jjjd.exec:\3jjjd.exe41⤵
- Executes dropped EXE
PID:2008 -
\??\c:\frlxlxf.exec:\frlxlxf.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4212 -
\??\c:\hbhtnb.exec:\hbhtnb.exe43⤵
- Executes dropped EXE
PID:4568 -
\??\c:\dvpdp.exec:\dvpdp.exe44⤵
- Executes dropped EXE
PID:1084 -
\??\c:\lxffrfr.exec:\lxffrfr.exe45⤵
- Executes dropped EXE
PID:1848 -
\??\c:\9bbnbb.exec:\9bbnbb.exe46⤵
- Executes dropped EXE
PID:2284 -
\??\c:\dppdv.exec:\dppdv.exe47⤵
- Executes dropped EXE
PID:3836 -
\??\c:\rxrfrfx.exec:\rxrfrfx.exe48⤵
- Executes dropped EXE
PID:4532 -
\??\c:\1lxrlxr.exec:\1lxrlxr.exe49⤵
- Executes dropped EXE
PID:3984 -
\??\c:\3bhbbb.exec:\3bhbbb.exe50⤵
- Executes dropped EXE
PID:4720 -
\??\c:\jvjjv.exec:\jvjjv.exe51⤵
- Executes dropped EXE
PID:792 -
\??\c:\1fxrrrf.exec:\1fxrrrf.exe52⤵
- Executes dropped EXE
PID:4152 -
\??\c:\nbbnbn.exec:\nbbnbn.exe53⤵
- Executes dropped EXE
PID:4792 -
\??\c:\dddpd.exec:\dddpd.exe54⤵
- Executes dropped EXE
PID:4312 -
\??\c:\lflfrrx.exec:\lflfrrx.exe55⤵
- Executes dropped EXE
PID:4320 -
\??\c:\fxxrllf.exec:\fxxrllf.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3744 -
\??\c:\tthbtb.exec:\tthbtb.exe57⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vppjd.exec:\vppjd.exe58⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jdjdd.exec:\jdjdd.exe59⤵
- Executes dropped EXE
PID:3180 -
\??\c:\lrxrffx.exec:\lrxrffx.exe60⤵
- Executes dropped EXE
PID:3812 -
\??\c:\bnhtnb.exec:\bnhtnb.exe61⤵
- Executes dropped EXE
PID:5092 -
\??\c:\9jjdv.exec:\9jjdv.exe62⤵
- Executes dropped EXE
PID:4656 -
\??\c:\lxxfrlx.exec:\lxxfrlx.exe63⤵
- Executes dropped EXE
PID:5072 -
\??\c:\nbhthh.exec:\nbhthh.exe64⤵
- Executes dropped EXE
PID:3232 -
\??\c:\dvvvv.exec:\dvvvv.exe65⤵
- Executes dropped EXE
PID:4876 -
\??\c:\9pvpp.exec:\9pvpp.exe66⤵PID:3248
-
\??\c:\frrlxxr.exec:\frrlxxr.exe67⤵PID:1004
-
\??\c:\bbnthb.exec:\bbnthb.exe68⤵PID:4556
-
\??\c:\pvdvd.exec:\pvdvd.exe69⤵PID:4020
-
\??\c:\pvpdj.exec:\pvpdj.exe70⤵PID:1624
-
\??\c:\9rrfxrx.exec:\9rrfxrx.exe71⤵
- System Location Discovery: System Language Discovery
PID:952 -
\??\c:\bhhnhb.exec:\bhhnhb.exe72⤵PID:3736
-
\??\c:\vdpdj.exec:\vdpdj.exe73⤵PID:3364
-
\??\c:\7frllll.exec:\7frllll.exe74⤵PID:3780
-
\??\c:\frxrrrr.exec:\frxrrrr.exe75⤵PID:4440
-
\??\c:\htbnhb.exec:\htbnhb.exe76⤵PID:3388
-
\??\c:\dpjdp.exec:\dpjdp.exe77⤵PID:3600
-
\??\c:\rllfxrl.exec:\rllfxrl.exe78⤵PID:1224
-
\??\c:\fxfxrll.exec:\fxfxrll.exe79⤵PID:4880
-
\??\c:\tntttt.exec:\tntttt.exe80⤵PID:3092
-
\??\c:\jvdvp.exec:\jvdvp.exe81⤵PID:628
-
\??\c:\5lfxllf.exec:\5lfxllf.exe82⤵PID:2700
-
\??\c:\7lrflff.exec:\7lrflff.exe83⤵PID:2176
-
\??\c:\5bttbt.exec:\5bttbt.exe84⤵PID:4912
-
\??\c:\vpjdv.exec:\vpjdv.exe85⤵PID:4504
-
\??\c:\rxfxllf.exec:\rxfxllf.exe86⤵PID:2168
-
\??\c:\tbbnbn.exec:\tbbnbn.exe87⤵PID:4848
-
\??\c:\tntnhn.exec:\tntnhn.exe88⤵PID:1944
-
\??\c:\jpdpp.exec:\jpdpp.exe89⤵PID:804
-
\??\c:\frlxfrf.exec:\frlxfrf.exe90⤵PID:1492
-
\??\c:\5rxlffx.exec:\5rxlffx.exe91⤵PID:4244
-
\??\c:\ntthth.exec:\ntthth.exe92⤵PID:1240
-
\??\c:\dvppj.exec:\dvppj.exe93⤵PID:2868
-
\??\c:\rflxrrl.exec:\rflxrrl.exe94⤵PID:916
-
\??\c:\3xxrllf.exec:\3xxrllf.exe95⤵PID:1996
-
\??\c:\nhhbth.exec:\nhhbth.exe96⤵PID:5108
-
\??\c:\vdvjv.exec:\vdvjv.exe97⤵PID:4420
-
\??\c:\lxxrffx.exec:\lxxrffx.exe98⤵PID:3872
-
\??\c:\bhhtnh.exec:\bhhtnh.exe99⤵PID:1552
-
\??\c:\vvdpd.exec:\vvdpd.exe100⤵PID:1900
-
\??\c:\fxxllfx.exec:\fxxllfx.exe101⤵PID:2884
-
\??\c:\lfxrfrf.exec:\lfxrfrf.exe102⤵PID:4796
-
\??\c:\htbtnn.exec:\htbtnn.exe103⤵PID:4012
-
\??\c:\pjjdd.exec:\pjjdd.exe104⤵PID:2352
-
\??\c:\pvvpj.exec:\pvvpj.exe105⤵PID:3120
-
\??\c:\5xfxxxl.exec:\5xfxxxl.exe106⤵PID:2396
-
\??\c:\5hnbhb.exec:\5hnbhb.exe107⤵PID:3980
-
\??\c:\jpvjd.exec:\jpvjd.exe108⤵PID:4716
-
\??\c:\pjpjv.exec:\pjpjv.exe109⤵PID:1576
-
\??\c:\fxlfrlr.exec:\fxlfrlr.exe110⤵PID:624
-
\??\c:\hntnht.exec:\hntnht.exe111⤵PID:876
-
\??\c:\tnnnbb.exec:\tnnnbb.exe112⤵PID:1844
-
\??\c:\dpppj.exec:\dpppj.exe113⤵PID:1708
-
\??\c:\djpjv.exec:\djpjv.exe114⤵PID:4648
-
\??\c:\7fxlrlx.exec:\7fxlrlx.exe115⤵PID:5048
-
\??\c:\7bhbtn.exec:\7bhbtn.exe116⤵PID:2200
-
\??\c:\vpvvj.exec:\vpvvj.exe117⤵PID:2936
-
\??\c:\rxxlxlx.exec:\rxxlxlx.exe118⤵PID:696
-
\??\c:\9xxrffl.exec:\9xxrffl.exe119⤵PID:3352
-
\??\c:\nbbtnh.exec:\nbbtnh.exe120⤵PID:1016
-
\??\c:\3hnbhb.exec:\3hnbhb.exe121⤵PID:3384
-
\??\c:\vvjvj.exec:\vvjvj.exe122⤵PID:2592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-