Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23-08-2024 09:19
Behavioral task
behavioral1
Sample
ae932a241807e355c0b9cd2607d65e40N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
ae932a241807e355c0b9cd2607d65e40N.exe
-
Size
168KB
-
MD5
ae932a241807e355c0b9cd2607d65e40
-
SHA1
4ba275458cf03bfdfb4478f27941a3f1cf9a2e59
-
SHA256
b85d0f188dc281c5cd10e5ad4090298565ae4c930ba7b733fd707861028f5dc3
-
SHA512
e5afbc8f59395cea7dce211e01a2ef07fb2e47afe4f26941ac1f7143f2b50f7c2b0b5af0b395d3ccdbade7d698316821c15f871027baa6dc537f2a657f8b017e
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BWlPFH4t+GNcAX:kcm4FmowdHoSphraHcpOFltH4t+Ib
Malware Config
Signatures
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/292-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2376-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-40-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2392-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2616-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-108-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2784-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1240-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1760-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1868-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1804-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-223-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/532-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/532-240-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1328-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-294-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2776-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1828-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1772-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/532-511-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1328-523-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-549-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2720-587-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1608-600-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-652-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2644-653-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1356-685-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-705-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1168-742-0x0000000000260000-0x0000000000287000-memory.dmp family_blackmoon behavioral1/memory/2576-910-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2644-921-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2872-934-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2772-947-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2772-949-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1524-1222-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1476-1278-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2912-1417-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2132 nbnthn.exe 2392 bbtthn.exe 2376 1jpjv.exe 2664 pjjpv.exe 2468 9xllrfl.exe 2844 3rrflrx.exe 2688 bnnnhh.exe 2712 xrlfrxx.exe 2616 1ppvd.exe 2748 pjpjp.exe 2596 fxxflrx.exe 748 nbnbnh.exe 1008 ppjjv.exe 2784 9lflrxf.exe 2640 3tbnth.exe 2808 tnbhhh.exe 2760 vvjpv.exe 1240 fllrflx.exe 1760 nhbnth.exe 2472 9tbtbt.exe 1868 7lfxffl.exe 2244 rfllxfl.exe 1804 7nbbhh.exe 2456 9bnbhn.exe 572 vpvjp.exe 532 xrfflfr.exe 1328 tntttb.exe 1948 7vvvj.exe 2328 5xlfllr.exe 1488 nbnnnh.exe 2476 hhbhht.exe 2552 jjdjp.exe 1712 ffrrxfl.exe 1732 fxfflrf.exe 2344 bthbnn.exe 2336 3djdj.exe 2776 vjpdd.exe 2860 3rrfllr.exe 1844 rffrlxx.exe 2832 nbhtnb.exe 2728 bbbthn.exe 2884 pdvvj.exe 1972 fxlfffl.exe 2932 lfxffrr.exe 2628 bttbtt.exe 2748 9btbhn.exe 2872 9jdjv.exe 1828 3jddv.exe 2960 7lrrrrr.exe 1008 rlfrxxx.exe 1012 7hbtbn.exe 2640 nhnthn.exe 492 pjvvj.exe 2352 lfxfrrf.exe 2760 llxfllr.exe 1772 bnbbhn.exe 2308 nnhhtt.exe 2296 jdpvj.exe 988 dvvvj.exe 2424 fxlrxff.exe 2380 btbbnt.exe 1100 jjjdd.exe 1804 3vjpv.exe 444 fxrrffl.exe -
resource yara_rule behavioral1/memory/292-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000122e3-5.dat upx behavioral1/memory/292-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016dbf-27.dat upx behavioral1/memory/2376-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016db1-18.dat upx behavioral1/files/0x0007000000016dd3-37.dat upx behavioral1/memory/2468-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016dda-47.dat upx behavioral1/memory/2664-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016ddf-56.dat upx behavioral1/memory/2392-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000170f2-62.dat upx behavioral1/memory/2688-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000018c16-72.dat upx behavioral1/files/0x0006000000018c3b-80.dat upx behavioral1/memory/2616-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2712-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018c44-90.dat upx behavioral1/files/0x0005000000019209-97.dat upx behavioral1/memory/2748-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2596-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193b7-109.dat upx behavioral1/files/0x00050000000193e6-117.dat upx behavioral1/files/0x000500000001940f-125.dat upx behavioral1/memory/2784-133-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2784-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2640-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019419-134.dat upx behavioral1/files/0x00050000000194cc-145.dat upx behavioral1/memory/2640-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194d4-154.dat upx behavioral1/memory/2808-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2760-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194e0-162.dat upx behavioral1/files/0x00050000000194e9-171.dat upx behavioral1/memory/1240-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1760-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194f3-180.dat upx behavioral1/files/0x0005000000019503-189.dat upx behavioral1/memory/1868-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019526-198.dat upx behavioral1/files/0x0005000000019553-206.dat upx behavioral1/files/0x0005000000019557-215.dat upx behavioral1/memory/1804-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019571-225.dat upx behavioral1/memory/532-234-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c9-233.dat upx behavioral1/files/0x000500000001960a-243.dat upx behavioral1/files/0x000500000001960c-252.dat upx behavioral1/memory/1328-248-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d66-260.dat upx behavioral1/memory/2328-261-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960e-269.dat upx behavioral1/files/0x0005000000019610-277.dat upx behavioral1/memory/2476-280-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019612-286.dat upx behavioral1/memory/2776-320-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2728-351-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1828-395-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1012-408-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1772-444-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2760-454-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/988-459-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fllrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xfxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bntbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxfllr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 292 wrote to memory of 2132 292 ae932a241807e355c0b9cd2607d65e40N.exe 30 PID 292 wrote to memory of 2132 292 ae932a241807e355c0b9cd2607d65e40N.exe 30 PID 292 wrote to memory of 2132 292 ae932a241807e355c0b9cd2607d65e40N.exe 30 PID 292 wrote to memory of 2132 292 ae932a241807e355c0b9cd2607d65e40N.exe 30 PID 2132 wrote to memory of 2392 2132 nbnthn.exe 31 PID 2132 wrote to memory of 2392 2132 nbnthn.exe 31 PID 2132 wrote to memory of 2392 2132 nbnthn.exe 31 PID 2132 wrote to memory of 2392 2132 nbnthn.exe 31 PID 2392 wrote to memory of 2376 2392 bbtthn.exe 32 PID 2392 wrote to memory of 2376 2392 bbtthn.exe 32 PID 2392 wrote to memory of 2376 2392 bbtthn.exe 32 PID 2392 wrote to memory of 2376 2392 bbtthn.exe 32 PID 2376 wrote to memory of 2664 2376 1jpjv.exe 33 PID 2376 wrote to memory of 2664 2376 1jpjv.exe 33 PID 2376 wrote to memory of 2664 2376 1jpjv.exe 33 PID 2376 wrote to memory of 2664 2376 1jpjv.exe 33 PID 2664 wrote to memory of 2468 2664 pjjpv.exe 34 PID 2664 wrote to memory of 2468 2664 pjjpv.exe 34 PID 2664 wrote to memory of 2468 2664 pjjpv.exe 34 PID 2664 wrote to memory of 2468 2664 pjjpv.exe 34 PID 2468 wrote to memory of 2844 2468 9xllrfl.exe 35 PID 2468 wrote to memory of 2844 2468 9xllrfl.exe 35 PID 2468 wrote to memory of 2844 2468 9xllrfl.exe 35 PID 2468 wrote to memory of 2844 2468 9xllrfl.exe 35 PID 2844 wrote to memory of 2688 2844 3rrflrx.exe 36 PID 2844 wrote to memory of 2688 2844 3rrflrx.exe 36 PID 2844 wrote to memory of 2688 2844 3rrflrx.exe 36 PID 2844 wrote to memory of 2688 2844 3rrflrx.exe 36 PID 2688 wrote to memory of 2712 2688 bnnnhh.exe 37 PID 2688 wrote to memory of 2712 2688 bnnnhh.exe 37 PID 2688 wrote to memory of 2712 2688 bnnnhh.exe 37 PID 2688 wrote to memory of 2712 2688 bnnnhh.exe 37 PID 2712 wrote to memory of 2616 2712 xrlfrxx.exe 38 PID 2712 wrote to memory of 2616 2712 xrlfrxx.exe 38 PID 2712 wrote to memory of 2616 2712 xrlfrxx.exe 38 PID 2712 wrote to memory of 2616 2712 xrlfrxx.exe 38 PID 2616 wrote to memory of 2748 2616 1ppvd.exe 39 PID 2616 wrote to memory of 2748 2616 1ppvd.exe 39 PID 2616 wrote to memory of 2748 2616 1ppvd.exe 39 PID 2616 wrote to memory of 2748 2616 1ppvd.exe 39 PID 2748 wrote to memory of 2596 2748 pjpjp.exe 40 PID 2748 wrote to memory of 2596 2748 pjpjp.exe 40 PID 2748 wrote to memory of 2596 2748 pjpjp.exe 40 PID 2748 wrote to memory of 2596 2748 pjpjp.exe 40 PID 2596 wrote to memory of 748 2596 fxxflrx.exe 41 PID 2596 wrote to memory of 748 2596 fxxflrx.exe 41 PID 2596 wrote to memory of 748 2596 fxxflrx.exe 41 PID 2596 wrote to memory of 748 2596 fxxflrx.exe 41 PID 748 wrote to memory of 1008 748 nbnbnh.exe 42 PID 748 wrote to memory of 1008 748 nbnbnh.exe 42 PID 748 wrote to memory of 1008 748 nbnbnh.exe 42 PID 748 wrote to memory of 1008 748 nbnbnh.exe 42 PID 1008 wrote to memory of 2784 1008 ppjjv.exe 43 PID 1008 wrote to memory of 2784 1008 ppjjv.exe 43 PID 1008 wrote to memory of 2784 1008 ppjjv.exe 43 PID 1008 wrote to memory of 2784 1008 ppjjv.exe 43 PID 2784 wrote to memory of 2640 2784 9lflrxf.exe 44 PID 2784 wrote to memory of 2640 2784 9lflrxf.exe 44 PID 2784 wrote to memory of 2640 2784 9lflrxf.exe 44 PID 2784 wrote to memory of 2640 2784 9lflrxf.exe 44 PID 2640 wrote to memory of 2808 2640 3tbnth.exe 45 PID 2640 wrote to memory of 2808 2640 3tbnth.exe 45 PID 2640 wrote to memory of 2808 2640 3tbnth.exe 45 PID 2640 wrote to memory of 2808 2640 3tbnth.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae932a241807e355c0b9cd2607d65e40N.exe"C:\Users\Admin\AppData\Local\Temp\ae932a241807e355c0b9cd2607d65e40N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:292 -
\??\c:\nbnthn.exec:\nbnthn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\bbtthn.exec:\bbtthn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\1jpjv.exec:\1jpjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\pjjpv.exec:\pjjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\9xllrfl.exec:\9xllrfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\3rrflrx.exec:\3rrflrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\bnnnhh.exec:\bnnnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\xrlfrxx.exec:\xrlfrxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\1ppvd.exec:\1ppvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\pjpjp.exec:\pjpjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\fxxflrx.exec:\fxxflrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\nbnbnh.exec:\nbnbnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\ppjjv.exec:\ppjjv.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\9lflrxf.exec:\9lflrxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\3tbnth.exec:\3tbnth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\tnbhhh.exec:\tnbhhh.exe17⤵
- Executes dropped EXE
PID:2808 -
\??\c:\vvjpv.exec:\vvjpv.exe18⤵
- Executes dropped EXE
PID:2760 -
\??\c:\fllrflx.exec:\fllrflx.exe19⤵
- Executes dropped EXE
PID:1240 -
\??\c:\nhbnth.exec:\nhbnth.exe20⤵
- Executes dropped EXE
PID:1760 -
\??\c:\9tbtbt.exec:\9tbtbt.exe21⤵
- Executes dropped EXE
PID:2472 -
\??\c:\7lfxffl.exec:\7lfxffl.exe22⤵
- Executes dropped EXE
PID:1868 -
\??\c:\rfllxfl.exec:\rfllxfl.exe23⤵
- Executes dropped EXE
PID:2244 -
\??\c:\7nbbhh.exec:\7nbbhh.exe24⤵
- Executes dropped EXE
PID:1804 -
\??\c:\9bnbhn.exec:\9bnbhn.exe25⤵
- Executes dropped EXE
PID:2456 -
\??\c:\vpvjp.exec:\vpvjp.exe26⤵
- Executes dropped EXE
PID:572 -
\??\c:\xrfflfr.exec:\xrfflfr.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:532 -
\??\c:\tntttb.exec:\tntttb.exe28⤵
- Executes dropped EXE
PID:1328 -
\??\c:\7vvvj.exec:\7vvvj.exe29⤵
- Executes dropped EXE
PID:1948 -
\??\c:\5xlfllr.exec:\5xlfllr.exe30⤵
- Executes dropped EXE
PID:2328 -
\??\c:\nbnnnh.exec:\nbnnnh.exe31⤵
- Executes dropped EXE
PID:1488 -
\??\c:\hhbhht.exec:\hhbhht.exe32⤵
- Executes dropped EXE
PID:2476 -
\??\c:\jjdjp.exec:\jjdjp.exe33⤵
- Executes dropped EXE
PID:2552 -
\??\c:\ffrrxfl.exec:\ffrrxfl.exe34⤵
- Executes dropped EXE
PID:1712 -
\??\c:\fxfflrf.exec:\fxfflrf.exe35⤵
- Executes dropped EXE
PID:1732 -
\??\c:\bthbnn.exec:\bthbnn.exe36⤵
- Executes dropped EXE
PID:2344 -
\??\c:\3djdj.exec:\3djdj.exe37⤵
- Executes dropped EXE
PID:2336 -
\??\c:\vjpdd.exec:\vjpdd.exe38⤵
- Executes dropped EXE
PID:2776 -
\??\c:\3rrfllr.exec:\3rrfllr.exe39⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rffrlxx.exec:\rffrlxx.exe40⤵
- Executes dropped EXE
PID:1844 -
\??\c:\nbhtnb.exec:\nbhtnb.exe41⤵
- Executes dropped EXE
PID:2832 -
\??\c:\bbbthn.exec:\bbbthn.exe42⤵
- Executes dropped EXE
PID:2728 -
\??\c:\pdvvj.exec:\pdvvj.exe43⤵
- Executes dropped EXE
PID:2884 -
\??\c:\fxlfffl.exec:\fxlfffl.exe44⤵
- Executes dropped EXE
PID:1972 -
\??\c:\lfxffrr.exec:\lfxffrr.exe45⤵
- Executes dropped EXE
PID:2932 -
\??\c:\bttbtt.exec:\bttbtt.exe46⤵
- Executes dropped EXE
PID:2628 -
\??\c:\9btbhn.exec:\9btbhn.exe47⤵
- Executes dropped EXE
PID:2748 -
\??\c:\9jdjv.exec:\9jdjv.exe48⤵
- Executes dropped EXE
PID:2872 -
\??\c:\3jddv.exec:\3jddv.exe49⤵
- Executes dropped EXE
PID:1828 -
\??\c:\7lrrrrr.exec:\7lrrrrr.exe50⤵
- Executes dropped EXE
PID:2960 -
\??\c:\rlfrxxx.exec:\rlfrxxx.exe51⤵
- Executes dropped EXE
PID:1008 -
\??\c:\7hbtbn.exec:\7hbtbn.exe52⤵
- Executes dropped EXE
PID:1012 -
\??\c:\nhnthn.exec:\nhnthn.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2640 -
\??\c:\pjvvj.exec:\pjvvj.exe54⤵
- Executes dropped EXE
PID:492 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe55⤵
- Executes dropped EXE
PID:2352 -
\??\c:\llxfllr.exec:\llxfllr.exe56⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bnbbhn.exec:\bnbbhn.exe57⤵
- Executes dropped EXE
PID:1772 -
\??\c:\nnhhtt.exec:\nnhhtt.exe58⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jdpvj.exec:\jdpvj.exe59⤵
- Executes dropped EXE
PID:2296 -
\??\c:\dvvvj.exec:\dvvvj.exe60⤵
- Executes dropped EXE
PID:988 -
\??\c:\fxlrxff.exec:\fxlrxff.exe61⤵
- Executes dropped EXE
PID:2424 -
\??\c:\btbbnt.exec:\btbbnt.exe62⤵
- Executes dropped EXE
PID:2380 -
\??\c:\jjjdd.exec:\jjjdd.exe63⤵
- Executes dropped EXE
PID:1100 -
\??\c:\3vjpv.exec:\3vjpv.exe64⤵
- Executes dropped EXE
PID:1804 -
\??\c:\fxrrffl.exec:\fxrrffl.exe65⤵
- Executes dropped EXE
PID:444 -
\??\c:\lfxlrxf.exec:\lfxlrxf.exe66⤵PID:1496
-
\??\c:\hbhbhh.exec:\hbhbhh.exe67⤵PID:2996
-
\??\c:\httnnn.exec:\httnnn.exe68⤵PID:532
-
\??\c:\1jvdd.exec:\1jvdd.exe69⤵PID:1328
-
\??\c:\jddpv.exec:\jddpv.exe70⤵PID:308
-
\??\c:\rlllrxx.exec:\rlllrxx.exe71⤵PID:2448
-
\??\c:\rrfffxf.exec:\rrfffxf.exe72⤵PID:2328
-
\??\c:\5hbhbb.exec:\5hbhbb.exe73⤵PID:2452
-
\??\c:\btttnn.exec:\btttnn.exe74⤵PID:2152
-
\??\c:\7dvdv.exec:\7dvdv.exe75⤵PID:2140
-
\??\c:\jjpvd.exec:\jjpvd.exe76⤵PID:1736
-
\??\c:\rrllrrx.exec:\rrllrrx.exe77⤵
- System Location Discovery: System Language Discovery
PID:1708 -
\??\c:\nhtbnt.exec:\nhtbnt.exe78⤵PID:1732
-
\??\c:\nhbntt.exec:\nhbntt.exe79⤵PID:2720
-
\??\c:\5djjj.exec:\5djjj.exe80⤵PID:2336
-
\??\c:\dvpvj.exec:\dvpvj.exe81⤵PID:2988
-
\??\c:\3fxxllr.exec:\3fxxllr.exe82⤵PID:1608
-
\??\c:\3frfrrx.exec:\3frfrrx.exe83⤵PID:2852
-
\??\c:\htbhnt.exec:\htbhnt.exe84⤵PID:2832
-
\??\c:\bttttb.exec:\bttttb.exe85⤵PID:2728
-
\??\c:\7vjjp.exec:\7vjjp.exe86⤵PID:2884
-
\??\c:\pddpd.exec:\pddpd.exe87⤵PID:1972
-
\??\c:\3lfflfr.exec:\3lfflfr.exe88⤵PID:2932
-
\??\c:\7llrffl.exec:\7llrffl.exe89⤵PID:2644
-
\??\c:\ntbnht.exec:\ntbnht.exe90⤵PID:2600
-
\??\c:\ttnntt.exec:\ttnntt.exe91⤵PID:1936
-
\??\c:\vppjp.exec:\vppjp.exe92⤵PID:1536
-
\??\c:\pjddj.exec:\pjddj.exe93⤵PID:1568
-
\??\c:\lfxfllr.exec:\lfxfllr.exe94⤵PID:1356
-
\??\c:\xrflrrx.exec:\xrflrrx.exe95⤵PID:2820
-
\??\c:\bnttbb.exec:\bnttbb.exe96⤵PID:2948
-
\??\c:\9bnnnt.exec:\9bnnnt.exe97⤵PID:2768
-
\??\c:\dvdjj.exec:\dvdjj.exe98⤵PID:1196
-
\??\c:\rlrrxfl.exec:\rlrrxfl.exe99⤵PID:1032
-
\??\c:\rlrlxfx.exec:\rlrlxfx.exe100⤵PID:1968
-
\??\c:\3hbnnt.exec:\3hbnnt.exe101⤵PID:908
-
\??\c:\nhhhbb.exec:\nhhhbb.exe102⤵PID:2052
-
\??\c:\jddjp.exec:\jddjp.exe103⤵PID:1168
-
\??\c:\dpjdp.exec:\dpjdp.exe104⤵PID:1476
-
\??\c:\fxlflrl.exec:\fxlflrl.exe105⤵PID:824
-
\??\c:\xrlllrr.exec:\xrlllrr.exe106⤵PID:1228
-
\??\c:\hbhntn.exec:\hbhntn.exe107⤵PID:760
-
\??\c:\1hnttt.exec:\1hnttt.exe108⤵PID:572
-
\??\c:\dvvvp.exec:\dvvvp.exe109⤵PID:2144
-
\??\c:\5jjvv.exec:\5jjvv.exe110⤵PID:1584
-
\??\c:\lfrrfxx.exec:\lfrrfxx.exe111⤵PID:2284
-
\??\c:\ffxxlrx.exec:\ffxxlrx.exe112⤵
- System Location Discovery: System Language Discovery
PID:2432 -
\??\c:\nnbtbb.exec:\nnbtbb.exe113⤵PID:308
-
\??\c:\tntbtb.exec:\tntbtb.exe114⤵PID:1504
-
\??\c:\ddjdj.exec:\ddjdj.exe115⤵PID:3016
-
\??\c:\jdppp.exec:\jdppp.exe116⤵PID:2544
-
\??\c:\llxfrrx.exec:\llxfrrx.exe117⤵PID:2392
-
\??\c:\7lxrxxl.exec:\7lxrxxl.exe118⤵PID:2004
-
\??\c:\3btthh.exec:\3btthh.exe119⤵PID:2376
-
\??\c:\3nnnhh.exec:\3nnnhh.exe120⤵PID:2388
-
\??\c:\vpdjp.exec:\vpdjp.exe121⤵PID:2468
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-