Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 17:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
27a8370afc0a3fb2d811e455799a2e20N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
27a8370afc0a3fb2d811e455799a2e20N.exe
-
Size
453KB
-
MD5
27a8370afc0a3fb2d811e455799a2e20
-
SHA1
ba4e606ce45d0ae09a86ffcc4ce1b7f4fa4b5401
-
SHA256
8eb4df24652a842b79a02de5ff4259cfe1db160c45282a8a49cd361799970fdd
-
SHA512
95c5a1d49f4f713c112858a25647ecacc5885a6d4327749c4a5cd59534dc006513519e9dc822ce4ccf31987cac1bf299bfa48d5171b26678e131ce2fe3bfc22a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeh:q7Tc2NYHUrAwfMp3CDh
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2344-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/560-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-65-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2928-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/388-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-196-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1344-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-335-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2672-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/752-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-453-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2768-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/448-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/628-501-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2452-563-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1912-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-748-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1680-767-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1508-774-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-830-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-955-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2052-959-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1352-1039-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1044 fxrxllr.exe 560 jjvdj.exe 1912 9btbtb.exe 2264 pjvvd.exe 2804 nhbhbh.exe 2932 bhthtb.exe 2928 fxllrxr.exe 2728 frxlrrx.exe 1988 nhtbnh.exe 2312 xrfrflr.exe 3016 bhntht.exe 2068 ddvdj.exe 884 rllrxrl.exe 1784 jpjpj.exe 2352 5hhhnt.exe 2008 rlllrlf.exe 388 htnnbb.exe 2868 jdjdj.exe 2760 hbbnbb.exe 2780 dpvdv.exe 1344 1vjjp.exe 1680 vdppv.exe 1744 vjddj.exe 980 dpdjd.exe 2204 7bnttb.exe 2340 vpjpv.exe 2456 tbthbb.exe 2244 dpddj.exe 1012 9hhhhb.exe 2516 9jvpv.exe 2344 9xlfllr.exe 1644 5jdvd.exe 2188 1lfrflr.exe 3004 thtntn.exe 1708 pdvdj.exe 2704 5xrlrrx.exe 2836 fxrfrfr.exe 2564 nnhnbb.exe 2584 ppddj.exe 2672 llffrrf.exe 2884 xxllfxl.exe 2552 nbtntb.exe 2676 jjvpv.exe 2632 5vjpp.exe 620 1lfxlxr.exe 680 hnhtbb.exe 2528 vpjpj.exe 836 lfflrfl.exe 2288 xlffrrf.exe 580 nhhhtt.exe 752 vjdjd.exe 1960 jjvjp.exe 1556 3lxfffl.exe 2624 hbttbt.exe 2768 vpddj.exe 448 vpvjv.exe 1632 rxxllxf.exe 1600 7bbbnb.exe 1700 pdjjv.exe 912 5vpdj.exe 628 3xrxxfl.exe 1656 hhtthn.exe 1052 djddp.exe 1056 vjppp.exe -
resource yara_rule behavioral1/memory/2344-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/388-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-381-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2632-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-454-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2768-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/376-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-767-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1508-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-823-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-830-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-917-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-955-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1652-1065-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2344 wrote to memory of 1044 2344 27a8370afc0a3fb2d811e455799a2e20N.exe 31 PID 2344 wrote to memory of 1044 2344 27a8370afc0a3fb2d811e455799a2e20N.exe 31 PID 2344 wrote to memory of 1044 2344 27a8370afc0a3fb2d811e455799a2e20N.exe 31 PID 2344 wrote to memory of 1044 2344 27a8370afc0a3fb2d811e455799a2e20N.exe 31 PID 1044 wrote to memory of 560 1044 fxrxllr.exe 32 PID 1044 wrote to memory of 560 1044 fxrxllr.exe 32 PID 1044 wrote to memory of 560 1044 fxrxllr.exe 32 PID 1044 wrote to memory of 560 1044 fxrxllr.exe 32 PID 560 wrote to memory of 1912 560 jjvdj.exe 33 PID 560 wrote to memory of 1912 560 jjvdj.exe 33 PID 560 wrote to memory of 1912 560 jjvdj.exe 33 PID 560 wrote to memory of 1912 560 jjvdj.exe 33 PID 1912 wrote to memory of 2264 1912 9btbtb.exe 34 PID 1912 wrote to memory of 2264 1912 9btbtb.exe 34 PID 1912 wrote to memory of 2264 1912 9btbtb.exe 34 PID 1912 wrote to memory of 2264 1912 9btbtb.exe 34 PID 2264 wrote to memory of 2804 2264 pjvvd.exe 35 PID 2264 wrote to memory of 2804 2264 pjvvd.exe 35 PID 2264 wrote to memory of 2804 2264 pjvvd.exe 35 PID 2264 wrote to memory of 2804 2264 pjvvd.exe 35 PID 2804 wrote to memory of 2932 2804 nhbhbh.exe 36 PID 2804 wrote to memory of 2932 2804 nhbhbh.exe 36 PID 2804 wrote to memory of 2932 2804 nhbhbh.exe 36 PID 2804 wrote to memory of 2932 2804 nhbhbh.exe 36 PID 2932 wrote to memory of 2928 2932 bhthtb.exe 37 PID 2932 wrote to memory of 2928 2932 bhthtb.exe 37 PID 2932 wrote to memory of 2928 2932 bhthtb.exe 37 PID 2932 wrote to memory of 2928 2932 bhthtb.exe 37 PID 2928 wrote to memory of 2728 2928 fxllrxr.exe 38 PID 2928 wrote to memory of 2728 2928 fxllrxr.exe 38 PID 2928 wrote to memory of 2728 2928 fxllrxr.exe 38 PID 2928 wrote to memory of 2728 2928 fxllrxr.exe 38 PID 2728 wrote to memory of 1988 2728 frxlrrx.exe 39 PID 2728 wrote to memory of 1988 2728 frxlrrx.exe 39 PID 2728 wrote to memory of 1988 2728 frxlrrx.exe 39 PID 2728 wrote to memory of 1988 2728 frxlrrx.exe 39 PID 1988 wrote to memory of 2312 1988 nhtbnh.exe 40 PID 1988 wrote to memory of 2312 1988 nhtbnh.exe 40 PID 1988 wrote to memory of 2312 1988 nhtbnh.exe 40 PID 1988 wrote to memory of 2312 1988 nhtbnh.exe 40 PID 2312 wrote to memory of 3016 2312 xrfrflr.exe 41 PID 2312 wrote to memory of 3016 2312 xrfrflr.exe 41 PID 2312 wrote to memory of 3016 2312 xrfrflr.exe 41 PID 2312 wrote to memory of 3016 2312 xrfrflr.exe 41 PID 3016 wrote to memory of 2068 3016 bhntht.exe 42 PID 3016 wrote to memory of 2068 3016 bhntht.exe 42 PID 3016 wrote to memory of 2068 3016 bhntht.exe 42 PID 3016 wrote to memory of 2068 3016 bhntht.exe 42 PID 2068 wrote to memory of 884 2068 ddvdj.exe 43 PID 2068 wrote to memory of 884 2068 ddvdj.exe 43 PID 2068 wrote to memory of 884 2068 ddvdj.exe 43 PID 2068 wrote to memory of 884 2068 ddvdj.exe 43 PID 884 wrote to memory of 1784 884 rllrxrl.exe 44 PID 884 wrote to memory of 1784 884 rllrxrl.exe 44 PID 884 wrote to memory of 1784 884 rllrxrl.exe 44 PID 884 wrote to memory of 1784 884 rllrxrl.exe 44 PID 1784 wrote to memory of 2352 1784 jpjpj.exe 45 PID 1784 wrote to memory of 2352 1784 jpjpj.exe 45 PID 1784 wrote to memory of 2352 1784 jpjpj.exe 45 PID 1784 wrote to memory of 2352 1784 jpjpj.exe 45 PID 2352 wrote to memory of 2008 2352 5hhhnt.exe 46 PID 2352 wrote to memory of 2008 2352 5hhhnt.exe 46 PID 2352 wrote to memory of 2008 2352 5hhhnt.exe 46 PID 2352 wrote to memory of 2008 2352 5hhhnt.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\27a8370afc0a3fb2d811e455799a2e20N.exe"C:\Users\Admin\AppData\Local\Temp\27a8370afc0a3fb2d811e455799a2e20N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\fxrxllr.exec:\fxrxllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\jjvdj.exec:\jjvdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\9btbtb.exec:\9btbtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\pjvvd.exec:\pjvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\nhbhbh.exec:\nhbhbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\bhthtb.exec:\bhthtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\fxllrxr.exec:\fxllrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\frxlrrx.exec:\frxlrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\nhtbnh.exec:\nhtbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\xrfrflr.exec:\xrfrflr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\bhntht.exec:\bhntht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\ddvdj.exec:\ddvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\rllrxrl.exec:\rllrxrl.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\jpjpj.exec:\jpjpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\5hhhnt.exec:\5hhhnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\rlllrlf.exec:\rlllrlf.exe17⤵
- Executes dropped EXE
PID:2008 -
\??\c:\htnnbb.exec:\htnnbb.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:388 -
\??\c:\jdjdj.exec:\jdjdj.exe19⤵
- Executes dropped EXE
PID:2868 -
\??\c:\hbbnbb.exec:\hbbnbb.exe20⤵
- Executes dropped EXE
PID:2760 -
\??\c:\dpvdv.exec:\dpvdv.exe21⤵
- Executes dropped EXE
PID:2780 -
\??\c:\1vjjp.exec:\1vjjp.exe22⤵
- Executes dropped EXE
PID:1344 -
\??\c:\vdppv.exec:\vdppv.exe23⤵
- Executes dropped EXE
PID:1680 -
\??\c:\vjddj.exec:\vjddj.exe24⤵
- Executes dropped EXE
PID:1744 -
\??\c:\dpdjd.exec:\dpdjd.exe25⤵
- Executes dropped EXE
PID:980 -
\??\c:\7bnttb.exec:\7bnttb.exe26⤵
- Executes dropped EXE
PID:2204 -
\??\c:\vpjpv.exec:\vpjpv.exe27⤵
- Executes dropped EXE
PID:2340 -
\??\c:\tbthbb.exec:\tbthbb.exe28⤵
- Executes dropped EXE
PID:2456 -
\??\c:\dpddj.exec:\dpddj.exe29⤵
- Executes dropped EXE
PID:2244 -
\??\c:\9hhhhb.exec:\9hhhhb.exe30⤵
- Executes dropped EXE
PID:1012 -
\??\c:\9jvpv.exec:\9jvpv.exe31⤵
- Executes dropped EXE
PID:2516 -
\??\c:\9xlfllr.exec:\9xlfllr.exe32⤵
- Executes dropped EXE
PID:2344 -
\??\c:\5jdvd.exec:\5jdvd.exe33⤵
- Executes dropped EXE
PID:1644 -
\??\c:\1lfrflr.exec:\1lfrflr.exe34⤵
- Executes dropped EXE
PID:2188 -
\??\c:\thtntn.exec:\thtntn.exe35⤵
- Executes dropped EXE
PID:3004 -
\??\c:\pdvdj.exec:\pdvdj.exe36⤵
- Executes dropped EXE
PID:1708 -
\??\c:\5xrlrrx.exec:\5xrlrrx.exe37⤵
- Executes dropped EXE
PID:2704 -
\??\c:\fxrfrfr.exec:\fxrfrfr.exe38⤵
- Executes dropped EXE
PID:2836 -
\??\c:\nnhnbb.exec:\nnhnbb.exe39⤵
- Executes dropped EXE
PID:2564 -
\??\c:\ppddj.exec:\ppddj.exe40⤵
- Executes dropped EXE
PID:2584 -
\??\c:\llffrrf.exec:\llffrrf.exe41⤵
- Executes dropped EXE
PID:2672 -
\??\c:\xxllfxl.exec:\xxllfxl.exe42⤵
- Executes dropped EXE
PID:2884 -
\??\c:\nbtntb.exec:\nbtntb.exe43⤵
- Executes dropped EXE
PID:2552 -
\??\c:\jjvpv.exec:\jjvpv.exe44⤵
- Executes dropped EXE
PID:2676 -
\??\c:\5vjpp.exec:\5vjpp.exe45⤵
- Executes dropped EXE
PID:2632 -
\??\c:\1lfxlxr.exec:\1lfxlxr.exe46⤵
- Executes dropped EXE
PID:620 -
\??\c:\hnhtbb.exec:\hnhtbb.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:680 -
\??\c:\vpjpj.exec:\vpjpj.exe48⤵
- Executes dropped EXE
PID:2528 -
\??\c:\lfflrfl.exec:\lfflrfl.exe49⤵
- Executes dropped EXE
PID:836 -
\??\c:\xlffrrf.exec:\xlffrrf.exe50⤵
- Executes dropped EXE
PID:2288 -
\??\c:\nhhhtt.exec:\nhhhtt.exe51⤵
- Executes dropped EXE
PID:580 -
\??\c:\vjdjd.exec:\vjdjd.exe52⤵
- Executes dropped EXE
PID:752 -
\??\c:\jjvjp.exec:\jjvjp.exe53⤵
- Executes dropped EXE
PID:1960 -
\??\c:\3lxfffl.exec:\3lxfffl.exe54⤵
- Executes dropped EXE
PID:1556 -
\??\c:\hbttbt.exec:\hbttbt.exe55⤵
- Executes dropped EXE
PID:2624 -
\??\c:\vpddj.exec:\vpddj.exe56⤵
- Executes dropped EXE
PID:2768 -
\??\c:\vpvjv.exec:\vpvjv.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:448 -
\??\c:\rxxllxf.exec:\rxxllxf.exe58⤵
- Executes dropped EXE
PID:1632 -
\??\c:\7bbbnb.exec:\7bbbnb.exe59⤵
- Executes dropped EXE
PID:1600 -
\??\c:\pdjjv.exec:\pdjjv.exe60⤵
- Executes dropped EXE
PID:1700 -
\??\c:\5vpdj.exec:\5vpdj.exe61⤵
- Executes dropped EXE
PID:912 -
\??\c:\3xrxxfl.exec:\3xrxxfl.exe62⤵
- Executes dropped EXE
PID:628 -
\??\c:\hhtthn.exec:\hhtthn.exe63⤵
- Executes dropped EXE
PID:1656 -
\??\c:\djddp.exec:\djddp.exe64⤵
- Executes dropped EXE
PID:1052 -
\??\c:\vjppp.exec:\vjppp.exe65⤵
- Executes dropped EXE
PID:1056 -
\??\c:\1lffflr.exec:\1lffflr.exe66⤵PID:2508
-
\??\c:\nbhhhn.exec:\nbhhhn.exe67⤵PID:1356
-
\??\c:\1bnnhh.exec:\1bnnhh.exe68⤵PID:1872
-
\??\c:\pjddd.exec:\pjddd.exe69⤵PID:1856
-
\??\c:\rlxxffl.exec:\rlxxffl.exe70⤵PID:2072
-
\??\c:\xrlrlxl.exec:\xrlrlxl.exe71⤵PID:1740
-
\??\c:\bnbtbh.exec:\bnbtbh.exe72⤵PID:2452
-
\??\c:\vppdp.exec:\vppdp.exe73⤵PID:1552
-
\??\c:\frxfrrr.exec:\frxfrrr.exe74⤵PID:2172
-
\??\c:\lfxflxl.exec:\lfxflxl.exe75⤵PID:2104
-
\??\c:\bnttnn.exec:\bnttnn.exe76⤵PID:2504
-
\??\c:\vjvpj.exec:\vjvpj.exe77⤵PID:2064
-
\??\c:\jjvdj.exec:\jjvdj.exe78⤵PID:1912
-
\??\c:\5rflrrr.exec:\5rflrrr.exe79⤵PID:2840
-
\??\c:\tnbhnt.exec:\tnbhnt.exe80⤵PID:2804
-
\??\c:\9tntbh.exec:\9tntbh.exe81⤵PID:2152
-
\??\c:\1jjjd.exec:\1jjjd.exe82⤵PID:2844
-
\??\c:\llffrrr.exec:\llffrrr.exe83⤵
- System Location Discovery: System Language Discovery
PID:2692 -
\??\c:\nhtbth.exec:\nhtbth.exe84⤵PID:2612
-
\??\c:\ddpvp.exec:\ddpvp.exe85⤵PID:2792
-
\??\c:\3jpvv.exec:\3jpvv.exe86⤵PID:2608
-
\??\c:\llflxfr.exec:\llflxfr.exe87⤵PID:2312
-
\??\c:\ttnbbh.exec:\ttnbbh.exe88⤵PID:352
-
\??\c:\nhbbnt.exec:\nhbbnt.exe89⤵PID:1048
-
\??\c:\5vpvd.exec:\5vpvd.exe90⤵PID:376
-
\??\c:\lxrxflr.exec:\lxrxflr.exe91⤵PID:2528
-
\??\c:\btnntb.exec:\btnntb.exe92⤵PID:1028
-
\??\c:\ttntnt.exec:\ttntnt.exe93⤵PID:536
-
\??\c:\vpjpj.exec:\vpjpj.exe94⤵PID:1696
-
\??\c:\frffllx.exec:\frffllx.exe95⤵PID:1628
-
\??\c:\xrfxfxf.exec:\xrfxfxf.exe96⤵PID:1960
-
\??\c:\nnhntt.exec:\nnhntt.exe97⤵PID:2764
-
\??\c:\pjppd.exec:\pjppd.exe98⤵PID:2756
-
\??\c:\vjvdd.exec:\vjvdd.exe99⤵PID:2772
-
\??\c:\fxrrffr.exec:\fxrrffr.exe100⤵PID:1852
-
\??\c:\tnhbnb.exec:\tnhbnb.exe101⤵PID:1916
-
\??\c:\dpddp.exec:\dpddp.exe102⤵PID:1732
-
\??\c:\jdvjv.exec:\jdvjv.exe103⤵PID:1700
-
\??\c:\3llfrrx.exec:\3llfrrx.exe104⤵PID:1680
-
\??\c:\1thhhb.exec:\1thhhb.exe105⤵PID:1088
-
\??\c:\3jvvj.exec:\3jvvj.exe106⤵PID:1508
-
\??\c:\jdpdd.exec:\jdpdd.exe107⤵PID:1560
-
\??\c:\5frxxxf.exec:\5frxxxf.exe108⤵PID:2532
-
\??\c:\9lffllx.exec:\9lffllx.exe109⤵PID:1984
-
\??\c:\nhttbh.exec:\nhttbh.exe110⤵PID:1588
-
\??\c:\3pvpv.exec:\3pvpv.exe111⤵PID:1672
-
\??\c:\9djjj.exec:\9djjj.exe112⤵PID:876
-
\??\c:\lfxfxlx.exec:\lfxfxlx.exe113⤵PID:3052
-
\??\c:\ntnnnn.exec:\ntnnnn.exe114⤵PID:1980
-
\??\c:\tnhtht.exec:\tnhtht.exe115⤵PID:2476
-
\??\c:\dvjjv.exec:\dvjjv.exe116⤵PID:1576
-
\??\c:\llfxflf.exec:\llfxflf.exe117⤵PID:2280
-
\??\c:\bbbbht.exec:\bbbbht.exe118⤵PID:560
-
\??\c:\bntnhn.exec:\bntnhn.exe119⤵PID:3004
-
\??\c:\jjvdv.exec:\jjvdv.exe120⤵PID:3068
-
\??\c:\lrlxlxx.exec:\lrlxlxx.exe121⤵PID:2808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-