Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 14:40
Behavioral task
behavioral1
Sample
0be6d36383740b348e9dd512fe6e7ae0N.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
General
-
Target
0be6d36383740b348e9dd512fe6e7ae0N.exe
-
Size
152KB
-
MD5
0be6d36383740b348e9dd512fe6e7ae0
-
SHA1
b705c55f1b16ab0fd88f905c4e2aa5d71bf2f0ca
-
SHA256
4f6ee6acc3f10f0da5622a22152e5b41a57aa7a84ad1ba61962846ccefa3249a
-
SHA512
bb18b22fa7568d516fe870ecffc747c9e44700329558268116cb711a82cc5e112d844c3ef9fc4a35e9ebf8d478d588fac599f078ba33b0c402e83724ed2f1766
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BWlPFH4to1odtckwz2n:kcm4FmowdHoSphraHcpOFltH4to1stce
Malware Config
Signatures
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/1496-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2172-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1888-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2224-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2956-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2400-115-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1224-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1224-129-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3000-127-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1860-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-150-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2916-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2068-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-179-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2116-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-170-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2932-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2076-210-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2412-219-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2368-229-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2368-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-227-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/896-236-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1500-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1500-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1768-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1496-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1296-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-412-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2068-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-471-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2060-478-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2404-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/888-511-0x0000000000280000-0x00000000002A7000-memory.dmp family_blackmoon behavioral1/memory/2236-558-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1180-584-0x00000000002D0000-0x00000000002F7000-memory.dmp family_blackmoon behavioral1/memory/1488-618-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2848-643-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2504-692-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/676-706-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-759-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2440-798-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/768-799-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/848-811-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2172 frxfrlr.exe 1888 nnbhtt.exe 2224 9hnbbb.exe 2964 pjddd.exe 2832 vvjpp.exe 2956 xlrxlrx.exe 3044 5hhbhh.exe 2848 hbhhtb.exe 2724 hnhbbt.exe 3000 fxlffrf.exe 2896 fxrxxxf.exe 2400 hbnbnn.exe 1224 jdjjv.exe 1860 lxlrxxf.exe 2916 bnhnbb.exe 2068 pdppv.exe 2876 rflrxxf.exe 2116 7bntbh.exe 1156 djdjd.exe 2932 xrxrffx.exe 2076 nbnhnh.exe 2412 vvvdj.exe 2368 7dppp.exe 896 lfrlffr.exe 1036 hbntbt.exe 1500 jjddv.exe 1264 3lxlxfl.exe 1768 hbtnbh.exe 2588 dpdjp.exe 1496 lxrlfxl.exe 2172 3frxfff.exe 1736 tnthbb.exe 2512 ddjjv.exe 1704 llxfrlr.exe 1296 bbtnbh.exe 2784 7ththn.exe 2688 jdddv.exe 1620 lxlrrrr.exe 1708 lfrxrxr.exe 2728 nhhnbt.exe 2712 9hbtbh.exe 2676 jvpdp.exe 2744 jddvp.exe 2188 lxlrxxr.exe 2504 rrflfll.exe 2600 bthnbh.exe 2400 ppjjv.exe 2592 vjvdj.exe 2860 llfllrf.exe 2920 1nbhnt.exe 2888 1nnnhh.exe 660 dpdvj.exe 2068 vpjvd.exe 2924 5xlflll.exe 572 bbhtnh.exe 1560 jdppj.exe 1608 vpppd.exe 2060 1xfxflr.exe 2404 ffrrllf.exe 2076 nhbbtt.exe 2640 dvpdv.exe 1652 jvdjv.exe 888 1lrrflx.exe 972 1lffrlx.exe -
resource yara_rule behavioral1/memory/1496-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000120fe-8.dat upx behavioral1/memory/2172-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1496-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016e98-18.dat upx behavioral1/memory/2172-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1888-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2964-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001752b-37.dat upx behavioral1/memory/2224-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001749f-28.dat upx behavioral1/memory/2832-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186be-46.dat upx behavioral1/files/0x00060000000186c4-55.dat upx behavioral1/memory/2956-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2956-59-0x00000000002B0000-0x00000000002D7000-memory.dmp upx behavioral1/files/0x00060000000186c9-64.dat upx behavioral1/files/0x0007000000018715-72.dat upx behavioral1/memory/2848-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3044-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2848-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019332-83.dat upx behavioral1/files/0x0005000000019601-94.dat upx behavioral1/memory/3000-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2724-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019603-101.dat upx behavioral1/files/0x0005000000019615-109.dat upx behavioral1/memory/2400-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2896-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019616-120.dat upx behavioral1/memory/1224-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019693-133.dat upx behavioral1/memory/1860-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1860-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019695-142.dat upx behavioral1/files/0x0005000000019950-154.dat upx behavioral1/memory/2068-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2916-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2068-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c2e-163.dat upx behavioral1/memory/2116-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c2f-175.dat upx behavioral1/memory/2876-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2876-170-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x0005000000019c30-184.dat upx behavioral1/files/0x0005000000019c4a-192.dat upx behavioral1/files/0x0005000000019cba-202.dat upx behavioral1/memory/2932-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019ce4-212.dat upx behavioral1/files/0x0005000000019d9d-220.dat upx behavioral1/files/0x0005000000019db1-233.dat upx behavioral1/memory/896-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2368-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019f7e-242.dat upx behavioral1/memory/1500-251-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019f9a-250.dat upx behavioral1/memory/1500-258-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0036000000016dbd-259.dat upx behavioral1/files/0x000500000001a069-267.dat upx behavioral1/files/0x000500000001a072-276.dat upx behavioral1/memory/1768-275-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2588-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a092-286.dat upx behavioral1/files/0x000500000001a2fb-294.dat upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llrrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bththh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1496 wrote to memory of 2172 1496 0be6d36383740b348e9dd512fe6e7ae0N.exe 30 PID 1496 wrote to memory of 2172 1496 0be6d36383740b348e9dd512fe6e7ae0N.exe 30 PID 1496 wrote to memory of 2172 1496 0be6d36383740b348e9dd512fe6e7ae0N.exe 30 PID 1496 wrote to memory of 2172 1496 0be6d36383740b348e9dd512fe6e7ae0N.exe 30 PID 2172 wrote to memory of 1888 2172 frxfrlr.exe 31 PID 2172 wrote to memory of 1888 2172 frxfrlr.exe 31 PID 2172 wrote to memory of 1888 2172 frxfrlr.exe 31 PID 2172 wrote to memory of 1888 2172 frxfrlr.exe 31 PID 1888 wrote to memory of 2224 1888 nnbhtt.exe 32 PID 1888 wrote to memory of 2224 1888 nnbhtt.exe 32 PID 1888 wrote to memory of 2224 1888 nnbhtt.exe 32 PID 1888 wrote to memory of 2224 1888 nnbhtt.exe 32 PID 2224 wrote to memory of 2964 2224 9hnbbb.exe 33 PID 2224 wrote to memory of 2964 2224 9hnbbb.exe 33 PID 2224 wrote to memory of 2964 2224 9hnbbb.exe 33 PID 2224 wrote to memory of 2964 2224 9hnbbb.exe 33 PID 2964 wrote to memory of 2832 2964 pjddd.exe 34 PID 2964 wrote to memory of 2832 2964 pjddd.exe 34 PID 2964 wrote to memory of 2832 2964 pjddd.exe 34 PID 2964 wrote to memory of 2832 2964 pjddd.exe 34 PID 2832 wrote to memory of 2956 2832 vvjpp.exe 35 PID 2832 wrote to memory of 2956 2832 vvjpp.exe 35 PID 2832 wrote to memory of 2956 2832 vvjpp.exe 35 PID 2832 wrote to memory of 2956 2832 vvjpp.exe 35 PID 2956 wrote to memory of 3044 2956 xlrxlrx.exe 36 PID 2956 wrote to memory of 3044 2956 xlrxlrx.exe 36 PID 2956 wrote to memory of 3044 2956 xlrxlrx.exe 36 PID 2956 wrote to memory of 3044 2956 xlrxlrx.exe 36 PID 3044 wrote to memory of 2848 3044 5hhbhh.exe 37 PID 3044 wrote to memory of 2848 3044 5hhbhh.exe 37 PID 3044 wrote to memory of 2848 3044 5hhbhh.exe 37 PID 3044 wrote to memory of 2848 3044 5hhbhh.exe 37 PID 2848 wrote to memory of 2724 2848 hbhhtb.exe 38 PID 2848 wrote to memory of 2724 2848 hbhhtb.exe 38 PID 2848 wrote to memory of 2724 2848 hbhhtb.exe 38 PID 2848 wrote to memory of 2724 2848 hbhhtb.exe 38 PID 2724 wrote to memory of 3000 2724 hnhbbt.exe 39 PID 2724 wrote to memory of 3000 2724 hnhbbt.exe 39 PID 2724 wrote to memory of 3000 2724 hnhbbt.exe 39 PID 2724 wrote to memory of 3000 2724 hnhbbt.exe 39 PID 3000 wrote to memory of 2896 3000 fxlffrf.exe 40 PID 3000 wrote to memory of 2896 3000 fxlffrf.exe 40 PID 3000 wrote to memory of 2896 3000 fxlffrf.exe 40 PID 3000 wrote to memory of 2896 3000 fxlffrf.exe 40 PID 2896 wrote to memory of 2400 2896 fxrxxxf.exe 41 PID 2896 wrote to memory of 2400 2896 fxrxxxf.exe 41 PID 2896 wrote to memory of 2400 2896 fxrxxxf.exe 41 PID 2896 wrote to memory of 2400 2896 fxrxxxf.exe 41 PID 2400 wrote to memory of 1224 2400 hbnbnn.exe 42 PID 2400 wrote to memory of 1224 2400 hbnbnn.exe 42 PID 2400 wrote to memory of 1224 2400 hbnbnn.exe 42 PID 2400 wrote to memory of 1224 2400 hbnbnn.exe 42 PID 1224 wrote to memory of 1860 1224 jdjjv.exe 43 PID 1224 wrote to memory of 1860 1224 jdjjv.exe 43 PID 1224 wrote to memory of 1860 1224 jdjjv.exe 43 PID 1224 wrote to memory of 1860 1224 jdjjv.exe 43 PID 1860 wrote to memory of 2916 1860 lxlrxxf.exe 44 PID 1860 wrote to memory of 2916 1860 lxlrxxf.exe 44 PID 1860 wrote to memory of 2916 1860 lxlrxxf.exe 44 PID 1860 wrote to memory of 2916 1860 lxlrxxf.exe 44 PID 2916 wrote to memory of 2068 2916 bnhnbb.exe 45 PID 2916 wrote to memory of 2068 2916 bnhnbb.exe 45 PID 2916 wrote to memory of 2068 2916 bnhnbb.exe 45 PID 2916 wrote to memory of 2068 2916 bnhnbb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0be6d36383740b348e9dd512fe6e7ae0N.exe"C:\Users\Admin\AppData\Local\Temp\0be6d36383740b348e9dd512fe6e7ae0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\frxfrlr.exec:\frxfrlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\nnbhtt.exec:\nnbhtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\9hnbbb.exec:\9hnbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\pjddd.exec:\pjddd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\vvjpp.exec:\vvjpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\xlrxlrx.exec:\xlrxlrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\5hhbhh.exec:\5hhbhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\hbhhtb.exec:\hbhhtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\hnhbbt.exec:\hnhbbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\fxlffrf.exec:\fxlffrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\fxrxxxf.exec:\fxrxxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\hbnbnn.exec:\hbnbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\jdjjv.exec:\jdjjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\lxlrxxf.exec:\lxlrxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\bnhnbb.exec:\bnhnbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\pdppv.exec:\pdppv.exe17⤵
- Executes dropped EXE
PID:2068 -
\??\c:\rflrxxf.exec:\rflrxxf.exe18⤵
- Executes dropped EXE
PID:2876 -
\??\c:\7bntbh.exec:\7bntbh.exe19⤵
- Executes dropped EXE
PID:2116 -
\??\c:\djdjd.exec:\djdjd.exe20⤵
- Executes dropped EXE
PID:1156 -
\??\c:\xrxrffx.exec:\xrxrffx.exe21⤵
- Executes dropped EXE
PID:2932 -
\??\c:\nbnhnh.exec:\nbnhnh.exe22⤵
- Executes dropped EXE
PID:2076 -
\??\c:\vvvdj.exec:\vvvdj.exe23⤵
- Executes dropped EXE
PID:2412 -
\??\c:\7dppp.exec:\7dppp.exe24⤵
- Executes dropped EXE
PID:2368 -
\??\c:\lfrlffr.exec:\lfrlffr.exe25⤵
- Executes dropped EXE
PID:896 -
\??\c:\hbntbt.exec:\hbntbt.exe26⤵
- Executes dropped EXE
PID:1036 -
\??\c:\jjddv.exec:\jjddv.exe27⤵
- Executes dropped EXE
PID:1500 -
\??\c:\3lxlxfl.exec:\3lxlxfl.exe28⤵
- Executes dropped EXE
PID:1264 -
\??\c:\hbtnbh.exec:\hbtnbh.exe29⤵
- Executes dropped EXE
PID:1768 -
\??\c:\dpdjp.exec:\dpdjp.exe30⤵
- Executes dropped EXE
PID:2588 -
\??\c:\lxrlfxl.exec:\lxrlfxl.exe31⤵
- Executes dropped EXE
PID:1496 -
\??\c:\3frxfff.exec:\3frxfff.exe32⤵
- Executes dropped EXE
PID:2172 -
\??\c:\tnthbb.exec:\tnthbb.exe33⤵
- Executes dropped EXE
PID:1736 -
\??\c:\ddjjv.exec:\ddjjv.exe34⤵
- Executes dropped EXE
PID:2512 -
\??\c:\llxfrlr.exec:\llxfrlr.exe35⤵
- Executes dropped EXE
PID:1704 -
\??\c:\bbtnbh.exec:\bbtnbh.exe36⤵
- Executes dropped EXE
PID:1296 -
\??\c:\7ththn.exec:\7ththn.exe37⤵
- Executes dropped EXE
PID:2784 -
\??\c:\jdddv.exec:\jdddv.exe38⤵
- Executes dropped EXE
PID:2688 -
\??\c:\lxlrrrr.exec:\lxlrrrr.exe39⤵
- Executes dropped EXE
PID:1620 -
\??\c:\lfrxrxr.exec:\lfrxrxr.exe40⤵
- Executes dropped EXE
PID:1708 -
\??\c:\nhhnbt.exec:\nhhnbt.exe41⤵
- Executes dropped EXE
PID:2728 -
\??\c:\9hbtbh.exec:\9hbtbh.exe42⤵
- Executes dropped EXE
PID:2712 -
\??\c:\jvpdp.exec:\jvpdp.exe43⤵
- Executes dropped EXE
PID:2676 -
\??\c:\jddvp.exec:\jddvp.exe44⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lxlrxxr.exec:\lxlrxxr.exe45⤵
- Executes dropped EXE
PID:2188 -
\??\c:\rrflfll.exec:\rrflfll.exe46⤵
- Executes dropped EXE
PID:2504 -
\??\c:\bthnbh.exec:\bthnbh.exe47⤵
- Executes dropped EXE
PID:2600 -
\??\c:\ppjjv.exec:\ppjjv.exe48⤵
- Executes dropped EXE
PID:2400 -
\??\c:\vjvdj.exec:\vjvdj.exe49⤵
- Executes dropped EXE
PID:2592 -
\??\c:\llfllrf.exec:\llfllrf.exe50⤵
- Executes dropped EXE
PID:2860 -
\??\c:\1nbhnt.exec:\1nbhnt.exe51⤵
- Executes dropped EXE
PID:2920 -
\??\c:\1nnnhh.exec:\1nnnhh.exe52⤵
- Executes dropped EXE
PID:2888 -
\??\c:\dpdvj.exec:\dpdvj.exe53⤵
- Executes dropped EXE
PID:660 -
\??\c:\vpjvd.exec:\vpjvd.exe54⤵
- Executes dropped EXE
PID:2068 -
\??\c:\5xlflll.exec:\5xlflll.exe55⤵
- Executes dropped EXE
PID:2924 -
\??\c:\bbhtnh.exec:\bbhtnh.exe56⤵
- Executes dropped EXE
PID:572 -
\??\c:\jdppj.exec:\jdppj.exe57⤵
- Executes dropped EXE
PID:1560 -
\??\c:\vpppd.exec:\vpppd.exe58⤵
- Executes dropped EXE
PID:1608 -
\??\c:\1xfxflr.exec:\1xfxflr.exe59⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ffrrllf.exec:\ffrrllf.exe60⤵
- Executes dropped EXE
PID:2404 -
\??\c:\nhbbtt.exec:\nhbbtt.exe61⤵
- Executes dropped EXE
PID:2076 -
\??\c:\dvpdv.exec:\dvpdv.exe62⤵
- Executes dropped EXE
PID:2640 -
\??\c:\jvdjv.exec:\jvdjv.exe63⤵
- Executes dropped EXE
PID:1652 -
\??\c:\1lrrflx.exec:\1lrrflx.exe64⤵
- Executes dropped EXE
PID:888 -
\??\c:\1lffrlx.exec:\1lffrlx.exe65⤵
- Executes dropped EXE
PID:972 -
\??\c:\7ntbth.exec:\7ntbth.exe66⤵PID:1980
-
\??\c:\jdpdv.exec:\jdpdv.exe67⤵PID:600
-
\??\c:\pjvpv.exec:\pjvpv.exe68⤵PID:1232
-
\??\c:\3flffff.exec:\3flffff.exe69⤵PID:1740
-
\??\c:\xxflxfl.exec:\xxflxfl.exe70⤵PID:1744
-
\??\c:\bthbbb.exec:\bthbbb.exe71⤵PID:2236
-
\??\c:\jjdvv.exec:\jjdvv.exe72⤵PID:2316
-
\??\c:\frxxlfl.exec:\frxxlfl.exe73⤵PID:2000
-
\??\c:\xlxfllr.exec:\xlxfllr.exe74⤵PID:1888
-
\??\c:\1tbbhb.exec:\1tbbhb.exe75⤵PID:1180
-
\??\c:\ttnbtb.exec:\ttnbtb.exe76⤵PID:2968
-
\??\c:\7jppp.exec:\7jppp.exe77⤵PID:1488
-
\??\c:\rlxlffl.exec:\rlxlffl.exe78⤵PID:1072
-
\??\c:\5xrxxrx.exec:\5xrxxrx.exe79⤵PID:2796
-
\??\c:\bbbbht.exec:\bbbbht.exe80⤵PID:1580
-
\??\c:\pjvjp.exec:\pjvjp.exe81⤵PID:2956
-
\??\c:\1vjpd.exec:\1vjpd.exe82⤵PID:2988
-
\??\c:\3rfllrr.exec:\3rfllrr.exe83⤵PID:2736
-
\??\c:\fxllllr.exec:\fxllllr.exe84⤵PID:2848
-
\??\c:\tntthh.exec:\tntthh.exe85⤵PID:1808
-
\??\c:\tntthh.exec:\tntthh.exe86⤵PID:2620
-
\??\c:\jvddj.exec:\jvddj.exe87⤵PID:2724
-
\??\c:\lflrflf.exec:\lflrflf.exe88⤵PID:2188
-
\??\c:\fxffllf.exec:\fxffllf.exe89⤵PID:2504
-
\??\c:\tntbtt.exec:\tntbtt.exe90⤵PID:620
-
\??\c:\9thnnt.exec:\9thnnt.exe91⤵PID:1224
-
\??\c:\pjvvj.exec:\pjvvj.exe92⤵PID:2880
-
\??\c:\ppjpp.exec:\ppjpp.exe93⤵PID:2108
-
\??\c:\fxlxflx.exec:\fxlxflx.exe94⤵PID:272
-
\??\c:\btbnnh.exec:\btbnnh.exe95⤵PID:676
-
\??\c:\btnttt.exec:\btnttt.exe96⤵PID:1648
-
\??\c:\jjvjv.exec:\jjvjv.exe97⤵PID:2876
-
\??\c:\vpjpd.exec:\vpjpd.exe98⤵PID:3068
-
\??\c:\ffrrxxl.exec:\ffrrxxl.exe99⤵PID:292
-
\??\c:\5htbnh.exec:\5htbnh.exe100⤵PID:1228
-
\??\c:\vdjjd.exec:\vdjjd.exe101⤵PID:2196
-
\??\c:\vppdj.exec:\vppdj.exe102⤵PID:1900
-
\??\c:\xlrrxlr.exec:\xlrrxlr.exe103⤵PID:2128
-
\??\c:\7llrllf.exec:\7llrllf.exe104⤵PID:2100
-
\??\c:\tnhhnn.exec:\tnhhnn.exe105⤵PID:768
-
\??\c:\9tnnnb.exec:\9tnnnb.exe106⤵PID:2084
-
\??\c:\3jdvj.exec:\3jdvj.exe107⤵PID:1876
-
\??\c:\rrlxllx.exec:\rrlxllx.exe108⤵PID:2440
-
\??\c:\lflfrll.exec:\lflfrll.exe109⤵PID:3036
-
\??\c:\thtbhh.exec:\thtbhh.exe110⤵PID:848
-
\??\c:\9thhnb.exec:\9thhnb.exe111⤵PID:1712
-
\??\c:\jjvdp.exec:\jjvdp.exe112⤵PID:2328
-
\??\c:\3rxxflr.exec:\3rxxflr.exe113⤵PID:1668
-
\??\c:\xlxrxfr.exec:\xlxrxfr.exe114⤵PID:2036
-
\??\c:\tnbntb.exec:\tnbntb.exe115⤵PID:2352
-
\??\c:\httttt.exec:\httttt.exe116⤵PID:2944
-
\??\c:\jvpvv.exec:\jvpvv.exe117⤵PID:2820
-
\??\c:\pdpdj.exec:\pdpdj.exe118⤵PID:1924
-
\??\c:\xrflxrf.exec:\xrflxrf.exe119⤵PID:1640
-
\??\c:\xrlxflx.exec:\xrlxflx.exe120⤵PID:2772
-
\??\c:\9ntbbn.exec:\9ntbbn.exe121⤵PID:1572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-