Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
05/08/2024, 12:50
Behavioral task
behavioral1
Sample
9058c6d39982d2450ea1c827584873a0N.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
120 seconds
General
-
Target
9058c6d39982d2450ea1c827584873a0N.exe
-
Size
114KB
-
MD5
9058c6d39982d2450ea1c827584873a0
-
SHA1
e4a46c869153043f8d4cf86adf12cbdef45bc117
-
SHA256
b12497f21fa129cd0c9f270e97d90cf0b4a904546d7e1e7dd7b0e9bf6ce54d5f
-
SHA512
0d2a8ae5867636f64cd5c0625bc9ed96c6d2e5ea9cd2ca50c8f67207365e7a5582cbaf7891fb07caf83b9055a913c57a0b1ce8fefda0c5062ea84a32d20e77f7
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutyaVszyKd+XqQPunI+UNjuH:9cm4FmowdHoSyAszBd+aQmn0NW
Malware Config
Signatures
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2120-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/540-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1240-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2572-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/332-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-147-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2460-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/552-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2060-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1060-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/956-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2156-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/272-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1268-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-406-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2768-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1168-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/864-540-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/568-547-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2028-550-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-620-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-652-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-715-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1176-805-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1340-819-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1020-1066-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-1091-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1044-1451-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 540 tttbtb.exe 1240 nhhthb.exe 2760 nhnbth.exe 2664 jjvdp.exe 2716 lfxlflx.exe 2572 llllxlx.exe 2704 ttnthn.exe 2592 jjdjv.exe 2200 xfxxrrl.exe 452 3fflxlf.exe 332 5nthnt.exe 1604 ppppd.exe 2492 rrxlxlx.exe 2732 ffflxll.exe 2460 nnntnt.exe 2952 djdpj.exe 552 fllrllx.exe 3004 3nnnth.exe 336 nnthbh.exe 1320 pjvvd.exe 1536 9lxfflf.exe 2336 7xfrflx.exe 2340 9nhhbb.exe 2060 pvvjv.exe 1060 xxxrxlf.exe 1180 fflflrl.exe 3012 9bhbtb.exe 956 vddvd.exe 2260 llrxrfx.exe 568 bbbthn.exe 2028 3ntnbt.exe 272 jjjjp.exe 2156 rllrxfr.exe 1992 xxrffrl.exe 2688 5nhhhn.exe 2744 3nhthn.exe 2800 ppjvp.exe 2712 9vppv.exe 2188 fxlffrx.exe 2900 btbhbh.exe 2596 hhhtth.exe 2620 jdvdp.exe 2588 jpjpd.exe 1268 rlfrrfl.exe 2888 7ffxrxr.exe 1044 nnbtnt.exe 2148 jjpdv.exe 2360 ddpjp.exe 2020 ffxlxxl.exe 2724 bbthhh.exe 2768 tbnhnh.exe 2944 dppjv.exe 2904 9rxxfrf.exe 2952 lrxxrll.exe 1956 hbnthh.exe 2040 hbbbht.exe 1204 jdpdp.exe 2000 pjpdp.exe 1944 3fxfxxf.exe 2992 9rxllfr.exe 2380 bttthh.exe 1168 ppvpd.exe 1424 ddvjv.exe 2060 rxxfflf.exe -
resource yara_rule behavioral1/memory/2120-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000120fe-11.dat upx behavioral1/memory/2120-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1240-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/540-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000193e0-18.dat upx behavioral1/files/0x000700000001948b-27.dat upx behavioral1/memory/1240-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2760-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2760-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000194bf-39.dat upx behavioral1/files/0x00060000000194c2-46.dat upx behavioral1/files/0x00060000000194ca-55.dat upx behavioral1/files/0x00080000000194d4-62.dat upx behavioral1/memory/2572-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2704-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000194da-74.dat upx behavioral1/memory/2704-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a421-80.dat upx behavioral1/files/0x000500000001a463-92.dat upx behavioral1/memory/2200-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a47f-99.dat upx behavioral1/files/0x000500000001a481-110.dat upx behavioral1/memory/332-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/332-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a48c-117.dat upx behavioral1/files/0x000500000001a48e-126.dat upx behavioral1/memory/2732-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a49d-136.dat upx behavioral1/files/0x000500000001a4a3-146.dat upx behavioral1/memory/2460-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4a5-154.dat upx behavioral1/memory/2952-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/552-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4a7-165.dat upx behavioral1/files/0x000500000001a4a9-171.dat upx behavioral1/files/0x000500000001a4ab-180.dat upx behavioral1/files/0x000500000001a4ad-188.dat upx behavioral1/files/0x000500000001a4af-197.dat upx behavioral1/files/0x000500000001a4b1-204.dat upx behavioral1/memory/2340-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b3-214.dat upx behavioral1/memory/2060-223-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b5-221.dat upx behavioral1/files/0x000500000001a4b7-233.dat upx behavioral1/memory/1060-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b9-240.dat upx behavioral1/memory/3012-241-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x002d000000019388-249.dat upx behavioral1/memory/956-251-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4bb-258.dat upx behavioral1/files/0x000500000001a4bd-267.dat upx behavioral1/memory/2260-266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4bf-275.dat upx behavioral1/memory/2028-277-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4c1-284.dat upx behavioral1/memory/2156-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/272-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2712-324-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-343-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1268-368-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2888-375-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2148-382-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2724-406-0x0000000000220000-0x0000000000247000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxlrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fflflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2120 wrote to memory of 540 2120 9058c6d39982d2450ea1c827584873a0N.exe 30 PID 2120 wrote to memory of 540 2120 9058c6d39982d2450ea1c827584873a0N.exe 30 PID 2120 wrote to memory of 540 2120 9058c6d39982d2450ea1c827584873a0N.exe 30 PID 2120 wrote to memory of 540 2120 9058c6d39982d2450ea1c827584873a0N.exe 30 PID 540 wrote to memory of 1240 540 tttbtb.exe 31 PID 540 wrote to memory of 1240 540 tttbtb.exe 31 PID 540 wrote to memory of 1240 540 tttbtb.exe 31 PID 540 wrote to memory of 1240 540 tttbtb.exe 31 PID 1240 wrote to memory of 2760 1240 nhhthb.exe 32 PID 1240 wrote to memory of 2760 1240 nhhthb.exe 32 PID 1240 wrote to memory of 2760 1240 nhhthb.exe 32 PID 1240 wrote to memory of 2760 1240 nhhthb.exe 32 PID 2760 wrote to memory of 2664 2760 nhnbth.exe 33 PID 2760 wrote to memory of 2664 2760 nhnbth.exe 33 PID 2760 wrote to memory of 2664 2760 nhnbth.exe 33 PID 2760 wrote to memory of 2664 2760 nhnbth.exe 33 PID 2664 wrote to memory of 2716 2664 jjvdp.exe 34 PID 2664 wrote to memory of 2716 2664 jjvdp.exe 34 PID 2664 wrote to memory of 2716 2664 jjvdp.exe 34 PID 2664 wrote to memory of 2716 2664 jjvdp.exe 34 PID 2716 wrote to memory of 2572 2716 lfxlflx.exe 35 PID 2716 wrote to memory of 2572 2716 lfxlflx.exe 35 PID 2716 wrote to memory of 2572 2716 lfxlflx.exe 35 PID 2716 wrote to memory of 2572 2716 lfxlflx.exe 35 PID 2572 wrote to memory of 2704 2572 llllxlx.exe 36 PID 2572 wrote to memory of 2704 2572 llllxlx.exe 36 PID 2572 wrote to memory of 2704 2572 llllxlx.exe 36 PID 2572 wrote to memory of 2704 2572 llllxlx.exe 36 PID 2704 wrote to memory of 2592 2704 ttnthn.exe 37 PID 2704 wrote to memory of 2592 2704 ttnthn.exe 37 PID 2704 wrote to memory of 2592 2704 ttnthn.exe 37 PID 2704 wrote to memory of 2592 2704 ttnthn.exe 37 PID 2592 wrote to memory of 2200 2592 jjdjv.exe 38 PID 2592 wrote to memory of 2200 2592 jjdjv.exe 38 PID 2592 wrote to memory of 2200 2592 jjdjv.exe 38 PID 2592 wrote to memory of 2200 2592 jjdjv.exe 38 PID 2200 wrote to memory of 452 2200 xfxxrrl.exe 39 PID 2200 wrote to memory of 452 2200 xfxxrrl.exe 39 PID 2200 wrote to memory of 452 2200 xfxxrrl.exe 39 PID 2200 wrote to memory of 452 2200 xfxxrrl.exe 39 PID 452 wrote to memory of 332 452 3fflxlf.exe 40 PID 452 wrote to memory of 332 452 3fflxlf.exe 40 PID 452 wrote to memory of 332 452 3fflxlf.exe 40 PID 452 wrote to memory of 332 452 3fflxlf.exe 40 PID 332 wrote to memory of 1604 332 5nthnt.exe 41 PID 332 wrote to memory of 1604 332 5nthnt.exe 41 PID 332 wrote to memory of 1604 332 5nthnt.exe 41 PID 332 wrote to memory of 1604 332 5nthnt.exe 41 PID 1604 wrote to memory of 2492 1604 ppppd.exe 42 PID 1604 wrote to memory of 2492 1604 ppppd.exe 42 PID 1604 wrote to memory of 2492 1604 ppppd.exe 42 PID 1604 wrote to memory of 2492 1604 ppppd.exe 42 PID 2492 wrote to memory of 2732 2492 rrxlxlx.exe 43 PID 2492 wrote to memory of 2732 2492 rrxlxlx.exe 43 PID 2492 wrote to memory of 2732 2492 rrxlxlx.exe 43 PID 2492 wrote to memory of 2732 2492 rrxlxlx.exe 43 PID 2732 wrote to memory of 2460 2732 ffflxll.exe 44 PID 2732 wrote to memory of 2460 2732 ffflxll.exe 44 PID 2732 wrote to memory of 2460 2732 ffflxll.exe 44 PID 2732 wrote to memory of 2460 2732 ffflxll.exe 44 PID 2460 wrote to memory of 2952 2460 nnntnt.exe 45 PID 2460 wrote to memory of 2952 2460 nnntnt.exe 45 PID 2460 wrote to memory of 2952 2460 nnntnt.exe 45 PID 2460 wrote to memory of 2952 2460 nnntnt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9058c6d39982d2450ea1c827584873a0N.exe"C:\Users\Admin\AppData\Local\Temp\9058c6d39982d2450ea1c827584873a0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\tttbtb.exec:\tttbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\nhhthb.exec:\nhhthb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\nhnbth.exec:\nhnbth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\jjvdp.exec:\jjvdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\lfxlflx.exec:\lfxlflx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\llllxlx.exec:\llllxlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\ttnthn.exec:\ttnthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\jjdjv.exec:\jjdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\xfxxrrl.exec:\xfxxrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\3fflxlf.exec:\3fflxlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\5nthnt.exec:\5nthnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\ppppd.exec:\ppppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\rrxlxlx.exec:\rrxlxlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\ffflxll.exec:\ffflxll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\nnntnt.exec:\nnntnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\djdpj.exec:\djdpj.exe17⤵
- Executes dropped EXE
PID:2952 -
\??\c:\fllrllx.exec:\fllrllx.exe18⤵
- Executes dropped EXE
PID:552 -
\??\c:\3nnnth.exec:\3nnnth.exe19⤵
- Executes dropped EXE
PID:3004 -
\??\c:\nnthbh.exec:\nnthbh.exe20⤵
- Executes dropped EXE
PID:336 -
\??\c:\pjvvd.exec:\pjvvd.exe21⤵
- Executes dropped EXE
PID:1320 -
\??\c:\9lxfflf.exec:\9lxfflf.exe22⤵
- Executes dropped EXE
PID:1536 -
\??\c:\7xfrflx.exec:\7xfrflx.exe23⤵
- Executes dropped EXE
PID:2336 -
\??\c:\9nhhbb.exec:\9nhhbb.exe24⤵
- Executes dropped EXE
PID:2340 -
\??\c:\pvvjv.exec:\pvvjv.exe25⤵
- Executes dropped EXE
PID:2060 -
\??\c:\xxxrxlf.exec:\xxxrxlf.exe26⤵
- Executes dropped EXE
PID:1060 -
\??\c:\fflflrl.exec:\fflflrl.exe27⤵
- Executes dropped EXE
PID:1180 -
\??\c:\9bhbtb.exec:\9bhbtb.exe28⤵
- Executes dropped EXE
PID:3012 -
\??\c:\vddvd.exec:\vddvd.exe29⤵
- Executes dropped EXE
PID:956 -
\??\c:\llrxrfx.exec:\llrxrfx.exe30⤵
- Executes dropped EXE
PID:2260 -
\??\c:\bbbthn.exec:\bbbthn.exe31⤵
- Executes dropped EXE
PID:568 -
\??\c:\3ntnbt.exec:\3ntnbt.exe32⤵
- Executes dropped EXE
PID:2028 -
\??\c:\jjjjp.exec:\jjjjp.exe33⤵
- Executes dropped EXE
PID:272 -
\??\c:\rllrxfr.exec:\rllrxfr.exe34⤵
- Executes dropped EXE
PID:2156 -
\??\c:\xxrffrl.exec:\xxrffrl.exe35⤵
- Executes dropped EXE
PID:1992 -
\??\c:\5nhhhn.exec:\5nhhhn.exe36⤵
- Executes dropped EXE
PID:2688 -
\??\c:\3nhthn.exec:\3nhthn.exe37⤵
- Executes dropped EXE
PID:2744 -
\??\c:\ppjvp.exec:\ppjvp.exe38⤵
- Executes dropped EXE
PID:2800 -
\??\c:\9vppv.exec:\9vppv.exe39⤵
- Executes dropped EXE
PID:2712 -
\??\c:\fxlffrx.exec:\fxlffrx.exe40⤵
- Executes dropped EXE
PID:2188 -
\??\c:\btbhbh.exec:\btbhbh.exe41⤵
- Executes dropped EXE
PID:2900 -
\??\c:\hhhtth.exec:\hhhtth.exe42⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jdvdp.exec:\jdvdp.exe43⤵
- Executes dropped EXE
PID:2620 -
\??\c:\jpjpd.exec:\jpjpd.exe44⤵
- Executes dropped EXE
PID:2588 -
\??\c:\rlfrrfl.exec:\rlfrrfl.exe45⤵
- Executes dropped EXE
PID:1268 -
\??\c:\7ffxrxr.exec:\7ffxrxr.exe46⤵
- Executes dropped EXE
PID:2888 -
\??\c:\nnbtnt.exec:\nnbtnt.exe47⤵
- Executes dropped EXE
PID:1044 -
\??\c:\jjpdv.exec:\jjpdv.exe48⤵
- Executes dropped EXE
PID:2148 -
\??\c:\ddpjp.exec:\ddpjp.exe49⤵
- Executes dropped EXE
PID:2360 -
\??\c:\ffxlxxl.exec:\ffxlxxl.exe50⤵
- Executes dropped EXE
PID:2020 -
\??\c:\bbthhh.exec:\bbthhh.exe51⤵
- Executes dropped EXE
PID:2724 -
\??\c:\tbnhnh.exec:\tbnhnh.exe52⤵
- Executes dropped EXE
PID:2768 -
\??\c:\dppjv.exec:\dppjv.exe53⤵
- Executes dropped EXE
PID:2944 -
\??\c:\9rxxfrf.exec:\9rxxfrf.exe54⤵
- Executes dropped EXE
PID:2904 -
\??\c:\lrxxrll.exec:\lrxxrll.exe55⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hbnthh.exec:\hbnthh.exe56⤵
- Executes dropped EXE
PID:1956 -
\??\c:\hbbbht.exec:\hbbbht.exe57⤵
- Executes dropped EXE
PID:2040 -
\??\c:\jdpdp.exec:\jdpdp.exe58⤵
- Executes dropped EXE
PID:1204 -
\??\c:\pjpdp.exec:\pjpdp.exe59⤵
- Executes dropped EXE
PID:2000 -
\??\c:\3fxfxxf.exec:\3fxfxxf.exe60⤵
- Executes dropped EXE
PID:1944 -
\??\c:\9rxllfr.exec:\9rxllfr.exe61⤵
- Executes dropped EXE
PID:2992 -
\??\c:\bttthh.exec:\bttthh.exe62⤵
- Executes dropped EXE
PID:2380 -
\??\c:\ppvpd.exec:\ppvpd.exe63⤵
- Executes dropped EXE
PID:1168 -
\??\c:\ddvjv.exec:\ddvjv.exe64⤵
- Executes dropped EXE
PID:1424 -
\??\c:\rxxfflf.exec:\rxxfflf.exe65⤵
- Executes dropped EXE
PID:2060 -
\??\c:\fxlfrxf.exec:\fxlfrxf.exe66⤵PID:1188
-
\??\c:\bhhbnh.exec:\bhhbnh.exe67⤵PID:1716
-
\??\c:\tnttbb.exec:\tnttbb.exe68⤵PID:1852
-
\??\c:\pjvjv.exec:\pjvjv.exe69⤵PID:2624
-
\??\c:\xrflrlx.exec:\xrflrlx.exe70⤵PID:2436
-
\??\c:\ffxflrf.exec:\ffxflrf.exe71⤵PID:2364
-
\??\c:\ttnbnn.exec:\ttnbnn.exe72⤵PID:864
-
\??\c:\7jpdv.exec:\7jpdv.exe73⤵PID:568
-
\??\c:\1dvjp.exec:\1dvjp.exe74⤵PID:2028
-
\??\c:\fxlrffr.exec:\fxlrffr.exe75⤵PID:1592
-
\??\c:\1tttnn.exec:\1tttnn.exe76⤵PID:756
-
\??\c:\5thnhh.exec:\5thnhh.exe77⤵
- System Location Discovery: System Language Discovery
PID:2636 -
\??\c:\vpdjj.exec:\vpdjj.exe78⤵PID:620
-
\??\c:\ppvdj.exec:\ppvdj.exe79⤵PID:2756
-
\??\c:\fxxrxfr.exec:\fxxrxfr.exe80⤵PID:2672
-
\??\c:\3lrxffx.exec:\3lrxffx.exe81⤵PID:2656
-
\??\c:\7nbthh.exec:\7nbthh.exe82⤵PID:2700
-
\??\c:\vvjdp.exec:\vvjdp.exe83⤵PID:2572
-
\??\c:\xrrxlrl.exec:\xrrxlrl.exe84⤵PID:2704
-
\??\c:\lflrffr.exec:\lflrffr.exe85⤵PID:2564
-
\??\c:\hhnnbb.exec:\hhnnbb.exe86⤵PID:3044
-
\??\c:\jvdpv.exec:\jvdpv.exe87⤵PID:2916
-
\??\c:\9pjvv.exec:\9pjvv.exe88⤵PID:1116
-
\??\c:\rlxrffl.exec:\rlxrffl.exe89⤵PID:332
-
\??\c:\ffxflrf.exec:\ffxflrf.exe90⤵PID:2480
-
\??\c:\7hbhnt.exec:\7hbhnt.exe91⤵PID:2848
-
\??\c:\jjdjv.exec:\jjdjv.exe92⤵PID:2492
-
\??\c:\1xrfrfr.exec:\1xrfrfr.exe93⤵PID:2828
-
\??\c:\rlflxxr.exec:\rlflxxr.exe94⤵PID:2728
-
\??\c:\bbtbtt.exec:\bbtbtt.exe95⤵PID:2908
-
\??\c:\ppppv.exec:\ppppv.exe96⤵PID:2124
-
\??\c:\vpdjp.exec:\vpdjp.exe97⤵PID:1924
-
\??\c:\ddvdp.exec:\ddvdp.exe98⤵PID:1776
-
\??\c:\xxxfrxf.exec:\xxxfrxf.exe99⤵PID:1964
-
\??\c:\7bntht.exec:\7bntht.exe100⤵PID:1048
-
\??\c:\5htbhh.exec:\5htbhh.exe101⤵PID:760
-
\??\c:\ddddj.exec:\ddddj.exe102⤵PID:2064
-
\??\c:\pjvvj.exec:\pjvvj.exe103⤵PID:2308
-
\??\c:\lllrlrl.exec:\lllrlrl.exe104⤵PID:2344
-
\??\c:\5frflrx.exec:\5frflrx.exe105⤵PID:1304
-
\??\c:\5bbntb.exec:\5bbntb.exe106⤵PID:972
-
\??\c:\thtntt.exec:\thtntt.exe107⤵PID:860
-
\??\c:\vjdjv.exec:\vjdjv.exe108⤵PID:1748
-
\??\c:\flfflrx.exec:\flfflrx.exe109⤵PID:684
-
\??\c:\rrxfllx.exec:\rrxfllx.exe110⤵PID:2392
-
\??\c:\hthtnn.exec:\hthtnn.exe111⤵PID:576
-
\??\c:\pjdvd.exec:\pjdvd.exe112⤵PID:2420
-
\??\c:\ppddj.exec:\ppddj.exe113⤵PID:2024
-
\??\c:\rrlllrr.exec:\rrlllrr.exe114⤵PID:1176
-
\??\c:\ffrflrf.exec:\ffrflrf.exe115⤵PID:2236
-
\??\c:\thttbb.exec:\thttbb.exe116⤵PID:1340
-
\??\c:\vvvjp.exec:\vvvjp.exe117⤵PID:848
-
\??\c:\5flrflx.exec:\5flrflx.exe118⤵PID:1552
-
\??\c:\7lllxff.exec:\7lllxff.exe119⤵PID:2764
-
\??\c:\hthnnt.exec:\hthnnt.exe120⤵PID:2820
-
\??\c:\bnbnbb.exec:\bnbnbb.exe121⤵PID:2680
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-