Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
01-08-2024 21:28
Behavioral task
behavioral1
Sample
2495f9de69e2c25a1d14a8401b36852450a9384c05ba096415697ddb50f5b75c.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
General
-
Target
2495f9de69e2c25a1d14a8401b36852450a9384c05ba096415697ddb50f5b75c.exe
-
Size
280KB
-
MD5
c0c9bd52377a618f51600a468ae3e9f9
-
SHA1
a4fb8c7dbb19ad15cfdee74aeb7c603e57e33d95
-
SHA256
2495f9de69e2c25a1d14a8401b36852450a9384c05ba096415697ddb50f5b75c
-
SHA512
146abb66de8870cdc5e837e1ff6800f94ec7525349b924a69661f3794d35642f2eda68d15dacb78f99276bdf3d23798772c494da83b59a333a09798946ed3fb1
-
SSDEEP
6144:7cm4FmowdHoSoXSBcm4Vcm4FmowdHoSphra+cm4FMhraHcpOaKHpU:B4wFHoSoXW434wFHoS3eg4aeFaKHpU
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral1/memory/2856-7-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2748-19-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2748-18-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2484-29-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2656-39-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2832-38-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2656-47-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2672-51-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2656-48-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2672-57-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2672-56-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/3024-67-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/3024-68-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/348-77-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2024-88-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2024-87-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2132-97-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1432-107-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1432-106-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2568-117-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2420-116-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1856-129-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2568-127-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2568-126-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1040-138-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1856-136-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1040-147-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1040-146-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1756-152-0x00000000002E0000-0x000000000032D000-memory.dmp family_blackmoon behavioral1/memory/1756-157-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2492-169-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2036-167-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2492-177-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2072-189-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2312-198-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2088-215-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/444-217-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/444-221-0x0000000000220000-0x000000000026D000-memory.dmp family_blackmoon behavioral1/memory/444-227-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/3048-235-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1012-244-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/560-247-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1012-245-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2092-257-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/560-255-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2092-266-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2392-277-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2968-275-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2968-274-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2392-287-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/316-288-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/316-297-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2856-306-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2708-309-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2708-315-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2748-324-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1956-332-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2604-340-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2652-347-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2676-348-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2676-355-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2248-356-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2248-363-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1388-372-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2748 llfxlxl.exe 2484 3vppj.exe 2832 bthnhh.exe 2656 9nhtbh.exe 2672 ffrxfrx.exe 3024 thntbb.exe 348 xxrllrx.exe 2024 btnbhh.exe 2132 ppvjd.exe 1432 lfxlxfr.exe 2420 hbtthh.exe 2568 9vpvj.exe 1856 ttthbn.exe 1040 7vjvv.exe 1756 nhtnbb.exe 2036 pjppv.exe 2492 xrlrfrf.exe 2072 tntnhh.exe 2312 rlxxfrx.exe 1316 vdppp.exe 2088 rxlffxl.exe 444 hhnnhh.exe 3048 pdpjv.exe 1012 tthbtb.exe 560 7jppv.exe 2092 nhttth.exe 2968 1vjvd.exe 2392 flrffxl.exe 316 ppvpp.exe 2856 1nhtth.exe 2708 jjdpd.exe 2748 lrxfxrr.exe 1956 btbthb.exe 2604 jvdpv.exe 2652 nthtnt.exe 2676 pdjvv.exe 2248 xfrrxxf.exe 1388 3nhnth.exe 2196 tnbhnh.exe 2236 fxrlffl.exe 2384 tttbht.exe 2688 pdjjj.exe 1740 fllxlff.exe 2788 9hbnbh.exe 836 1dpjp.exe 2660 bhhthb.exe 1040 dvpdj.exe 1428 vdddv.exe 1760 tbbntt.exe 2492 ppdjp.exe 2452 9dppd.exe 2084 rlrlrrx.exe 1476 nhthnt.exe 1776 pjdvd.exe 1616 jdpvv.exe 3036 lfrrxxl.exe 2308 hhthtb.exe 756 jdppp.exe 1944 xlrlrrx.exe 2476 frxfxrl.exe 1972 5nhhbb.exe 2684 vpdjv.exe 1816 lflrxxf.exe 2516 llxlrfr.exe -
resource yara_rule behavioral1/memory/2856-0-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x0007000000012119-5.dat upx behavioral1/memory/2856-7-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2748-10-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2748-13-0x00000000002D0000-0x000000000031D000-memory.dmp upx behavioral1/files/0x0008000000016d4b-17.dat upx behavioral1/memory/2484-20-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2748-19-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x0008000000016d67-27.dat upx behavioral1/memory/2484-29-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2656-39-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2832-38-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x0007000000016d72-37.dat upx behavioral1/files/0x0007000000016d76-46.dat upx behavioral1/memory/2672-51-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2656-48-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x0007000000016d92-58.dat upx behavioral1/memory/2672-57-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/3024-59-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x0009000000016da7-66.dat upx behavioral1/memory/348-70-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/3024-68-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/348-77-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2024-81-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x0008000000016dbd-79.dat upx behavioral1/files/0x000500000001870a-86.dat upx behavioral1/memory/2024-88-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2132-91-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x000500000001871a-99.dat upx behavioral1/memory/2132-97-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/1432-107-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x00050000000187a7-105.dat upx behavioral1/files/0x00050000000187ac-114.dat upx behavioral1/memory/2568-117-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2420-116-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2568-121-0x00000000003B0000-0x00000000003FD000-memory.dmp upx behavioral1/files/0x00050000000187c0-125.dat upx behavioral1/memory/1856-129-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2568-127-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/1040-138-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x0006000000018b7f-137.dat upx behavioral1/memory/1856-136-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/1040-147-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x0006000000018bb0-148.dat upx behavioral1/memory/1756-151-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/1756-152-0x00000000002E0000-0x000000000032D000-memory.dmp upx behavioral1/files/0x0006000000018be5-158.dat upx behavioral1/memory/1756-157-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x0006000000018bf9-165.dat upx behavioral1/memory/2492-169-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2036-168-0x00000000003B0000-0x00000000003FD000-memory.dmp upx behavioral1/memory/2036-167-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2492-176-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x0033000000016caa-178.dat upx behavioral1/memory/2492-177-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2072-179-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2072-183-0x0000000000330000-0x000000000037D000-memory.dmp upx behavioral1/files/0x0006000000018c05-187.dat upx behavioral1/memory/2072-189-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/1316-199-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2312-198-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x0006000000018c11-197.dat upx behavioral1/files/0x0006000000018c31-206.dat upx behavioral1/memory/2088-215-0x0000000000400000-0x000000000044D000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2856 wrote to memory of 2748 2856 2495f9de69e2c25a1d14a8401b36852450a9384c05ba096415697ddb50f5b75c.exe 30 PID 2856 wrote to memory of 2748 2856 2495f9de69e2c25a1d14a8401b36852450a9384c05ba096415697ddb50f5b75c.exe 30 PID 2856 wrote to memory of 2748 2856 2495f9de69e2c25a1d14a8401b36852450a9384c05ba096415697ddb50f5b75c.exe 30 PID 2856 wrote to memory of 2748 2856 2495f9de69e2c25a1d14a8401b36852450a9384c05ba096415697ddb50f5b75c.exe 30 PID 2748 wrote to memory of 2484 2748 llfxlxl.exe 31 PID 2748 wrote to memory of 2484 2748 llfxlxl.exe 31 PID 2748 wrote to memory of 2484 2748 llfxlxl.exe 31 PID 2748 wrote to memory of 2484 2748 llfxlxl.exe 31 PID 2484 wrote to memory of 2832 2484 3vppj.exe 32 PID 2484 wrote to memory of 2832 2484 3vppj.exe 32 PID 2484 wrote to memory of 2832 2484 3vppj.exe 32 PID 2484 wrote to memory of 2832 2484 3vppj.exe 32 PID 2832 wrote to memory of 2656 2832 bthnhh.exe 33 PID 2832 wrote to memory of 2656 2832 bthnhh.exe 33 PID 2832 wrote to memory of 2656 2832 bthnhh.exe 33 PID 2832 wrote to memory of 2656 2832 bthnhh.exe 33 PID 2656 wrote to memory of 2672 2656 9nhtbh.exe 34 PID 2656 wrote to memory of 2672 2656 9nhtbh.exe 34 PID 2656 wrote to memory of 2672 2656 9nhtbh.exe 34 PID 2656 wrote to memory of 2672 2656 9nhtbh.exe 34 PID 2672 wrote to memory of 3024 2672 ffrxfrx.exe 35 PID 2672 wrote to memory of 3024 2672 ffrxfrx.exe 35 PID 2672 wrote to memory of 3024 2672 ffrxfrx.exe 35 PID 2672 wrote to memory of 3024 2672 ffrxfrx.exe 35 PID 3024 wrote to memory of 348 3024 thntbb.exe 36 PID 3024 wrote to memory of 348 3024 thntbb.exe 36 PID 3024 wrote to memory of 348 3024 thntbb.exe 36 PID 3024 wrote to memory of 348 3024 thntbb.exe 36 PID 348 wrote to memory of 2024 348 xxrllrx.exe 37 PID 348 wrote to memory of 2024 348 xxrllrx.exe 37 PID 348 wrote to memory of 2024 348 xxrllrx.exe 37 PID 348 wrote to memory of 2024 348 xxrllrx.exe 37 PID 2024 wrote to memory of 2132 2024 btnbhh.exe 38 PID 2024 wrote to memory of 2132 2024 btnbhh.exe 38 PID 2024 wrote to memory of 2132 2024 btnbhh.exe 38 PID 2024 wrote to memory of 2132 2024 btnbhh.exe 38 PID 2132 wrote to memory of 1432 2132 ppvjd.exe 39 PID 2132 wrote to memory of 1432 2132 ppvjd.exe 39 PID 2132 wrote to memory of 1432 2132 ppvjd.exe 39 PID 2132 wrote to memory of 1432 2132 ppvjd.exe 39 PID 1432 wrote to memory of 2420 1432 lfxlxfr.exe 40 PID 1432 wrote to memory of 2420 1432 lfxlxfr.exe 40 PID 1432 wrote to memory of 2420 1432 lfxlxfr.exe 40 PID 1432 wrote to memory of 2420 1432 lfxlxfr.exe 40 PID 2420 wrote to memory of 2568 2420 hbtthh.exe 41 PID 2420 wrote to memory of 2568 2420 hbtthh.exe 41 PID 2420 wrote to memory of 2568 2420 hbtthh.exe 41 PID 2420 wrote to memory of 2568 2420 hbtthh.exe 41 PID 2568 wrote to memory of 1856 2568 9vpvj.exe 42 PID 2568 wrote to memory of 1856 2568 9vpvj.exe 42 PID 2568 wrote to memory of 1856 2568 9vpvj.exe 42 PID 2568 wrote to memory of 1856 2568 9vpvj.exe 42 PID 1856 wrote to memory of 1040 1856 ttthbn.exe 43 PID 1856 wrote to memory of 1040 1856 ttthbn.exe 43 PID 1856 wrote to memory of 1040 1856 ttthbn.exe 43 PID 1856 wrote to memory of 1040 1856 ttthbn.exe 43 PID 1040 wrote to memory of 1756 1040 7vjvv.exe 44 PID 1040 wrote to memory of 1756 1040 7vjvv.exe 44 PID 1040 wrote to memory of 1756 1040 7vjvv.exe 44 PID 1040 wrote to memory of 1756 1040 7vjvv.exe 44 PID 1756 wrote to memory of 2036 1756 nhtnbb.exe 45 PID 1756 wrote to memory of 2036 1756 nhtnbb.exe 45 PID 1756 wrote to memory of 2036 1756 nhtnbb.exe 45 PID 1756 wrote to memory of 2036 1756 nhtnbb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2495f9de69e2c25a1d14a8401b36852450a9384c05ba096415697ddb50f5b75c.exe"C:\Users\Admin\AppData\Local\Temp\2495f9de69e2c25a1d14a8401b36852450a9384c05ba096415697ddb50f5b75c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\llfxlxl.exec:\llfxlxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\3vppj.exec:\3vppj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\bthnhh.exec:\bthnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\9nhtbh.exec:\9nhtbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\ffrxfrx.exec:\ffrxfrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\thntbb.exec:\thntbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\xxrllrx.exec:\xxrllrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\btnbhh.exec:\btnbhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\ppvjd.exec:\ppvjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\lfxlxfr.exec:\lfxlxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\hbtthh.exec:\hbtthh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\9vpvj.exec:\9vpvj.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\ttthbn.exec:\ttthbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\7vjvv.exec:\7vjvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\nhtnbb.exec:\nhtnbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\pjppv.exec:\pjppv.exe17⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xrlrfrf.exec:\xrlrfrf.exe18⤵
- Executes dropped EXE
PID:2492 -
\??\c:\tntnhh.exec:\tntnhh.exe19⤵
- Executes dropped EXE
PID:2072 -
\??\c:\rlxxfrx.exec:\rlxxfrx.exe20⤵
- Executes dropped EXE
PID:2312 -
\??\c:\vdppp.exec:\vdppp.exe21⤵
- Executes dropped EXE
PID:1316 -
\??\c:\rxlffxl.exec:\rxlffxl.exe22⤵
- Executes dropped EXE
PID:2088 -
\??\c:\hhnnhh.exec:\hhnnhh.exe23⤵
- Executes dropped EXE
PID:444 -
\??\c:\pdpjv.exec:\pdpjv.exe24⤵
- Executes dropped EXE
PID:3048 -
\??\c:\tthbtb.exec:\tthbtb.exe25⤵
- Executes dropped EXE
PID:1012 -
\??\c:\7jppv.exec:\7jppv.exe26⤵
- Executes dropped EXE
PID:560 -
\??\c:\nhttth.exec:\nhttth.exe27⤵
- Executes dropped EXE
PID:2092 -
\??\c:\1vjvd.exec:\1vjvd.exe28⤵
- Executes dropped EXE
PID:2968 -
\??\c:\flrffxl.exec:\flrffxl.exe29⤵
- Executes dropped EXE
PID:2392 -
\??\c:\ppvpp.exec:\ppvpp.exe30⤵
- Executes dropped EXE
PID:316 -
\??\c:\1nhtth.exec:\1nhtth.exe31⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jjdpd.exec:\jjdpd.exe32⤵
- Executes dropped EXE
PID:2708 -
\??\c:\lrxfxrr.exec:\lrxfxrr.exe33⤵
- Executes dropped EXE
PID:2748 -
\??\c:\btbthb.exec:\btbthb.exe34⤵
- Executes dropped EXE
PID:1956 -
\??\c:\jvdpv.exec:\jvdpv.exe35⤵
- Executes dropped EXE
PID:2604 -
\??\c:\nthtnt.exec:\nthtnt.exe36⤵
- Executes dropped EXE
PID:2652 -
\??\c:\pdjvv.exec:\pdjvv.exe37⤵
- Executes dropped EXE
PID:2676 -
\??\c:\xfrrxxf.exec:\xfrrxxf.exe38⤵
- Executes dropped EXE
PID:2248 -
\??\c:\3nhnth.exec:\3nhnth.exe39⤵
- Executes dropped EXE
PID:1388 -
\??\c:\tnbhnh.exec:\tnbhnh.exe40⤵
- Executes dropped EXE
PID:2196 -
\??\c:\fxrlffl.exec:\fxrlffl.exe41⤵
- Executes dropped EXE
PID:2236 -
\??\c:\tttbht.exec:\tttbht.exe42⤵
- Executes dropped EXE
PID:2384 -
\??\c:\pdjjj.exec:\pdjjj.exe43⤵
- Executes dropped EXE
PID:2688 -
\??\c:\fllxlff.exec:\fllxlff.exe44⤵
- Executes dropped EXE
PID:1740 -
\??\c:\9hbnbh.exec:\9hbnbh.exe45⤵
- Executes dropped EXE
PID:2788 -
\??\c:\1dpjp.exec:\1dpjp.exe46⤵
- Executes dropped EXE
PID:836 -
\??\c:\bhhthb.exec:\bhhthb.exe47⤵
- Executes dropped EXE
PID:2660 -
\??\c:\dvpdj.exec:\dvpdj.exe48⤵
- Executes dropped EXE
PID:1040 -
\??\c:\vdddv.exec:\vdddv.exe49⤵
- Executes dropped EXE
PID:1428 -
\??\c:\tbbntt.exec:\tbbntt.exe50⤵
- Executes dropped EXE
PID:1760 -
\??\c:\ppdjp.exec:\ppdjp.exe51⤵
- Executes dropped EXE
PID:2492 -
\??\c:\9dppd.exec:\9dppd.exe52⤵
- Executes dropped EXE
PID:2452 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe53⤵
- Executes dropped EXE
PID:2084 -
\??\c:\nhthnt.exec:\nhthnt.exe54⤵
- Executes dropped EXE
PID:1476 -
\??\c:\pjdvd.exec:\pjdvd.exe55⤵
- Executes dropped EXE
PID:1776 -
\??\c:\jdpvv.exec:\jdpvv.exe56⤵
- Executes dropped EXE
PID:1616 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe57⤵
- Executes dropped EXE
PID:3036 -
\??\c:\hhthtb.exec:\hhthtb.exe58⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jdppp.exec:\jdppp.exe59⤵
- Executes dropped EXE
PID:756 -
\??\c:\xlrlrrx.exec:\xlrlrrx.exe60⤵
- Executes dropped EXE
PID:1944 -
\??\c:\frxfxrl.exec:\frxfxrl.exe61⤵
- Executes dropped EXE
PID:2476 -
\??\c:\5nhhbb.exec:\5nhhbb.exe62⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vpdjv.exec:\vpdjv.exe63⤵
- Executes dropped EXE
PID:2684 -
\??\c:\lflrxxf.exec:\lflrxxf.exe64⤵
- Executes dropped EXE
PID:1816 -
\??\c:\llxlrfr.exec:\llxlrfr.exe65⤵
- Executes dropped EXE
PID:2516 -
\??\c:\bnbbhn.exec:\bnbbhn.exe66⤵PID:1612
-
\??\c:\9pdpd.exec:\9pdpd.exe67⤵PID:2800
-
\??\c:\dvjdj.exec:\dvjdj.exe68⤵PID:2836
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe69⤵PID:2760
-
\??\c:\nhtbhh.exec:\nhtbhh.exe70⤵PID:2768
-
\??\c:\bttbnt.exec:\bttbnt.exe71⤵PID:2604
-
\??\c:\ddpvj.exec:\ddpvj.exe72⤵PID:2168
-
\??\c:\vpddp.exec:\vpddp.exe73⤵PID:692
-
\??\c:\fflxxxx.exec:\fflxxxx.exe74⤵PID:2248
-
\??\c:\xfrxlrx.exec:\xfrxlrx.exe75⤵PID:2180
-
\??\c:\bbnhnn.exec:\bbnhnn.exe76⤵PID:2564
-
\??\c:\pdppv.exec:\pdppv.exe77⤵PID:2372
-
\??\c:\vdjdd.exec:\vdjdd.exe78⤵PID:2776
-
\??\c:\xrlfrrx.exec:\xrlfrrx.exe79⤵PID:2688
-
\??\c:\btbhtt.exec:\btbhtt.exe80⤵
- System Location Discovery: System Language Discovery
PID:1740 -
\??\c:\btbhth.exec:\btbhth.exe81⤵PID:2844
-
\??\c:\vdvvj.exec:\vdvvj.exe82⤵PID:2884
-
\??\c:\7jvdp.exec:\7jvdp.exe83⤵PID:1320
-
\??\c:\1rllllr.exec:\1rllllr.exe84⤵PID:1040
-
\??\c:\btnbnb.exec:\btnbnb.exe85⤵PID:912
-
\??\c:\nhnttb.exec:\nhnttb.exe86⤵PID:2932
-
\??\c:\vpvjd.exec:\vpvjd.exe87⤵PID:2444
-
\??\c:\frxxffl.exec:\frxxffl.exe88⤵PID:2448
-
\??\c:\1lrfxfx.exec:\1lrfxfx.exe89⤵PID:1480
-
\??\c:\hhtnth.exec:\hhtnth.exe90⤵PID:1248
-
\??\c:\hhttnb.exec:\hhttnb.exe91⤵PID:604
-
\??\c:\jjpdp.exec:\jjpdp.exe92⤵PID:2988
-
\??\c:\7bhbbh.exec:\7bhbbh.exe93⤵PID:1312
-
\??\c:\bntbbb.exec:\bntbbb.exe94⤵PID:3036
-
\??\c:\ddvjv.exec:\ddvjv.exe95⤵PID:2912
-
\??\c:\lflrrxl.exec:\lflrrxl.exe96⤵PID:1736
-
\??\c:\xxxfllx.exec:\xxxfllx.exe97⤵PID:1944
-
\??\c:\3thnnn.exec:\3thnnn.exe98⤵PID:2536
-
\??\c:\hnnntn.exec:\hnnntn.exe99⤵PID:2540
-
\??\c:\vpdpd.exec:\vpdpd.exe100⤵PID:2684
-
\??\c:\dpdvd.exec:\dpdvd.exe101⤵PID:2860
-
\??\c:\fflfxff.exec:\fflfxff.exe102⤵PID:2752
-
\??\c:\xxlxlrf.exec:\xxlxlrf.exe103⤵PID:1612
-
\??\c:\thtnhh.exec:\thtnhh.exe104⤵PID:2628
-
\??\c:\dvdvj.exec:\dvdvj.exe105⤵PID:2736
-
\??\c:\vdjdp.exec:\vdjdp.exe106⤵
- System Location Discovery: System Language Discovery
PID:2596 -
\??\c:\llfrfxl.exec:\llfrfxl.exe107⤵PID:2484
-
\??\c:\nnbhhh.exec:\nnbhhh.exe108⤵PID:2604
-
\??\c:\ntbnhh.exec:\ntbnhh.exe109⤵PID:776
-
\??\c:\vvvjd.exec:\vvvjd.exe110⤵PID:1168
-
\??\c:\3vppd.exec:\3vppd.exe111⤵PID:732
-
\??\c:\fxxfllx.exec:\fxxfllx.exe112⤵PID:2024
-
\??\c:\ttnthn.exec:\ttnthn.exe113⤵PID:2104
-
\??\c:\7bhnbb.exec:\7bhnbb.exe114⤵PID:2384
-
\??\c:\pjddj.exec:\pjddj.exe115⤵PID:2424
-
\??\c:\xxllrxr.exec:\xxllrxr.exe116⤵PID:1948
-
\??\c:\llxrrlr.exec:\llxrrlr.exe117⤵PID:2568
-
\??\c:\btnnbh.exec:\btnnbh.exe118⤵PID:1780
-
\??\c:\3bhhnt.exec:\3bhhnt.exe119⤵PID:1976
-
\??\c:\5ddpd.exec:\5ddpd.exe120⤵PID:2996
-
\??\c:\9xxfrfr.exec:\9xxfrfr.exe121⤵PID:1728
-
\??\c:\pjvdj.exec:\pjvdj.exe122⤵PID:2952
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-