Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 21:22
Behavioral task
behavioral1
Sample
dca215016b4b0aa98faca380d505dc20655d7becd7b2834971d6874b37005cf6N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
dca215016b4b0aa98faca380d505dc20655d7becd7b2834971d6874b37005cf6N.exe
-
Size
454KB
-
MD5
f540cc90da324159c4c2dd482b1b1ae0
-
SHA1
298548ce4a9a99c682698e4ec13b4e91ca3543be
-
SHA256
dca215016b4b0aa98faca380d505dc20655d7becd7b2834971d6874b37005cf6
-
SHA512
44f72aa592f6265298f8956acf43d08e673205d768d7b7e9674099cab0bac12c3bb06d7335d619ccd2eb4801539dfc6ae3ede374b18e7c0c4caf0281199f5ca8
-
SSDEEP
12288:04wFHoSyd0V3eFp3IDvSbh5nPYERM8mXzplo5:rd0gFp3lz1/uzplo5
Malware Config
Signatures
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2900-7-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1728-21-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2552-17-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2112-31-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2172-39-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2740-55-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2908-66-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2604-92-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2768-90-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2604-99-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2956-134-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1940-142-0x00000000005D0000-0x0000000000608000-memory.dmp family_blackmoon behavioral1/memory/1676-146-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2064-154-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2984-172-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2148-183-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2584-192-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1232-213-0x0000000000360000-0x0000000000398000-memory.dmp family_blackmoon behavioral1/memory/1904-232-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1636-243-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1992-252-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2508-273-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2080-284-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2464-293-0x00000000003C0000-0x00000000003F8000-memory.dmp family_blackmoon behavioral1/memory/2084-298-0x0000000000220000-0x0000000000258000-memory.dmp family_blackmoon behavioral1/memory/2084-303-0x0000000000220000-0x0000000000258000-memory.dmp family_blackmoon behavioral1/memory/1552-322-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1700-331-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2848-351-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2768-383-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2604-390-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2488-397-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2948-416-0x0000000000220000-0x0000000000258000-memory.dmp family_blackmoon behavioral1/memory/2960-443-0x00000000003C0000-0x00000000003F8000-memory.dmp family_blackmoon behavioral1/memory/2368-468-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1652-536-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2400-595-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2648-639-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/3012-659-0x0000000000220000-0x0000000000258000-memory.dmp family_blackmoon behavioral1/memory/1504-678-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/3012-679-0x0000000000220000-0x0000000000258000-memory.dmp family_blackmoon behavioral1/memory/1808-682-0x0000000000220000-0x0000000000258000-memory.dmp family_blackmoon behavioral1/memory/2916-694-0x0000000000220000-0x0000000000258000-memory.dmp family_blackmoon behavioral1/memory/1856-722-0x00000000001C0000-0x00000000001F8000-memory.dmp family_blackmoon behavioral1/memory/1768-736-0x0000000000250000-0x0000000000288000-memory.dmp family_blackmoon behavioral1/memory/560-778-0x0000000000220000-0x0000000000258000-memory.dmp family_blackmoon behavioral1/memory/892-798-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2120-867-0x00000000001B0000-0x00000000001E8000-memory.dmp family_blackmoon behavioral1/memory/2016-894-0x0000000000220000-0x0000000000258000-memory.dmp family_blackmoon behavioral1/memory/2868-908-0x0000000000220000-0x0000000000258000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2552 206028.exe 1728 bnbhbt.exe 2112 rxrxrll.exe 2172 nhnbtb.exe 2740 0424000.exe 2864 m6446.exe 2908 bthhth.exe 2888 tntbnt.exe 2768 60284.exe 2604 66608.exe 1940 ttnbbt.exe 2332 k44088.exe 2356 884084.exe 2956 4480808.exe 1676 jdpvp.exe 2064 60246.exe 2008 fllxrxx.exe 2984 nhhbtb.exe 896 u442460.exe 2148 4828286.exe 2584 djdpj.exe 3044 btnbhh.exe 1232 llfrrfr.exe 1680 3nhnth.exe 1904 ppvjd.exe 1636 62686.exe 1992 o046848.exe 2464 9xxfrff.exe 2508 888602.exe 2080 48240.exe 1936 5llflrr.exe 2084 i228286.exe 2560 8846406.exe 1968 q26240.exe 1552 flflrxl.exe 1700 flfflrl.exe 2572 tnbhth.exe 2904 rlfrrxr.exe 2848 a8868.exe 2876 048428.exe 3024 u008020.exe 2808 jjdvd.exe 2856 48246.exe 2768 6084002.exe 2604 1xrxlrx.exe 2488 dvjvp.exe 668 022602.exe 1080 2264286.exe 2948 i440468.exe 1724 ntnhbn.exe 2780 6804068.exe 1944 6840668.exe 2960 00406.exe 3004 04808.exe 2964 xrlrfrr.exe 1604 42806.exe 2368 482466.exe 1388 jpvjd.exe 856 22068.exe 2584 9vjdj.exe 1784 hbntbt.exe 1316 ppppj.exe 1232 048422.exe 2432 vdpvp.exe -
resource yara_rule behavioral1/memory/2900-1-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x000a000000012283-8.dat upx behavioral1/memory/2552-9-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2900-7-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x00080000000173c2-19.dat upx behavioral1/memory/1728-21-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2552-17-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x00080000000173c8-28.dat upx behavioral1/memory/2112-31-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2172-39-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x00070000000174af-46.dat upx behavioral1/files/0x00080000000173de-38.dat upx behavioral1/files/0x00070000000174f5-53.dat upx behavioral1/memory/2740-55-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x000700000001756a-63.dat upx behavioral1/memory/2908-66-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x00080000000175ed-74.dat upx behavioral1/files/0x0008000000018660-81.dat upx behavioral1/files/0x000500000001934d-89.dat upx behavioral1/memory/2604-92-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2768-90-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x0005000000019361-101.dat upx behavioral1/memory/2604-99-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x0009000000016ddf-111.dat upx behavioral1/files/0x000500000001936c-118.dat upx behavioral1/files/0x00050000000193d5-127.dat upx behavioral1/files/0x00050000000193ee-135.dat upx behavioral1/memory/2956-134-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x000500000001941f-147.dat upx behavioral1/memory/1676-146-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/1676-144-0x00000000001B0000-0x00000000001E8000-memory.dmp upx behavioral1/memory/2064-154-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x000500000001942e-156.dat upx behavioral1/files/0x0005000000019439-164.dat upx behavioral1/memory/2984-172-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x0005000000019444-170.dat upx behavioral1/memory/2148-183-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x000500000001944e-182.dat upx behavioral1/memory/2584-192-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x0005000000019462-191.dat upx behavioral1/files/0x0005000000019468-199.dat upx behavioral1/files/0x00050000000194a4-207.dat upx behavioral1/files/0x00050000000194ba-215.dat upx behavioral1/files/0x000500000001951c-224.dat upx behavioral1/memory/1904-232-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x0005000000019524-234.dat upx behavioral1/memory/1636-243-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/1992-244-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x00050000000195a6-242.dat upx behavioral1/memory/1992-252-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x00050000000195e5-253.dat upx behavioral1/files/0x000500000001961c-262.dat upx behavioral1/memory/2080-275-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x000500000001961e-274.dat upx behavioral1/memory/2508-273-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x0005000000019620-286.dat upx behavioral1/memory/1936-285-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2080-284-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x0005000000019621-294.dat upx behavioral1/memory/1552-322-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/1700-323-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/1700-331-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/1700-330-0x00000000003A0000-0x00000000003D8000-memory.dmp upx behavioral1/memory/2848-351-0x0000000000400000-0x0000000000438000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k86684.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8884286.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i424660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8684262.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xllllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 262862.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 040280.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 022602.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64002.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2900 wrote to memory of 2552 2900 dca215016b4b0aa98faca380d505dc20655d7becd7b2834971d6874b37005cf6N.exe 30 PID 2900 wrote to memory of 2552 2900 dca215016b4b0aa98faca380d505dc20655d7becd7b2834971d6874b37005cf6N.exe 30 PID 2900 wrote to memory of 2552 2900 dca215016b4b0aa98faca380d505dc20655d7becd7b2834971d6874b37005cf6N.exe 30 PID 2900 wrote to memory of 2552 2900 dca215016b4b0aa98faca380d505dc20655d7becd7b2834971d6874b37005cf6N.exe 30 PID 2552 wrote to memory of 1728 2552 206028.exe 31 PID 2552 wrote to memory of 1728 2552 206028.exe 31 PID 2552 wrote to memory of 1728 2552 206028.exe 31 PID 2552 wrote to memory of 1728 2552 206028.exe 31 PID 1728 wrote to memory of 2112 1728 bnbhbt.exe 32 PID 1728 wrote to memory of 2112 1728 bnbhbt.exe 32 PID 1728 wrote to memory of 2112 1728 bnbhbt.exe 32 PID 1728 wrote to memory of 2112 1728 bnbhbt.exe 32 PID 2112 wrote to memory of 2172 2112 rxrxrll.exe 33 PID 2112 wrote to memory of 2172 2112 rxrxrll.exe 33 PID 2112 wrote to memory of 2172 2112 rxrxrll.exe 33 PID 2112 wrote to memory of 2172 2112 rxrxrll.exe 33 PID 2172 wrote to memory of 2740 2172 nhnbtb.exe 34 PID 2172 wrote to memory of 2740 2172 nhnbtb.exe 34 PID 2172 wrote to memory of 2740 2172 nhnbtb.exe 34 PID 2172 wrote to memory of 2740 2172 nhnbtb.exe 34 PID 2740 wrote to memory of 2864 2740 0424000.exe 35 PID 2740 wrote to memory of 2864 2740 0424000.exe 35 PID 2740 wrote to memory of 2864 2740 0424000.exe 35 PID 2740 wrote to memory of 2864 2740 0424000.exe 35 PID 2864 wrote to memory of 2908 2864 m6446.exe 36 PID 2864 wrote to memory of 2908 2864 m6446.exe 36 PID 2864 wrote to memory of 2908 2864 m6446.exe 36 PID 2864 wrote to memory of 2908 2864 m6446.exe 36 PID 2908 wrote to memory of 2888 2908 bthhth.exe 37 PID 2908 wrote to memory of 2888 2908 bthhth.exe 37 PID 2908 wrote to memory of 2888 2908 bthhth.exe 37 PID 2908 wrote to memory of 2888 2908 bthhth.exe 37 PID 2888 wrote to memory of 2768 2888 tntbnt.exe 38 PID 2888 wrote to memory of 2768 2888 tntbnt.exe 38 PID 2888 wrote to memory of 2768 2888 tntbnt.exe 38 PID 2888 wrote to memory of 2768 2888 tntbnt.exe 38 PID 2768 wrote to memory of 2604 2768 60284.exe 39 PID 2768 wrote to memory of 2604 2768 60284.exe 39 PID 2768 wrote to memory of 2604 2768 60284.exe 39 PID 2768 wrote to memory of 2604 2768 60284.exe 39 PID 2604 wrote to memory of 1940 2604 66608.exe 40 PID 2604 wrote to memory of 1940 2604 66608.exe 40 PID 2604 wrote to memory of 1940 2604 66608.exe 40 PID 2604 wrote to memory of 1940 2604 66608.exe 40 PID 1940 wrote to memory of 2332 1940 ttnbbt.exe 41 PID 1940 wrote to memory of 2332 1940 ttnbbt.exe 41 PID 1940 wrote to memory of 2332 1940 ttnbbt.exe 41 PID 1940 wrote to memory of 2332 1940 ttnbbt.exe 41 PID 2332 wrote to memory of 2356 2332 k44088.exe 42 PID 2332 wrote to memory of 2356 2332 k44088.exe 42 PID 2332 wrote to memory of 2356 2332 k44088.exe 42 PID 2332 wrote to memory of 2356 2332 k44088.exe 42 PID 2356 wrote to memory of 2956 2356 884084.exe 43 PID 2356 wrote to memory of 2956 2356 884084.exe 43 PID 2356 wrote to memory of 2956 2356 884084.exe 43 PID 2356 wrote to memory of 2956 2356 884084.exe 43 PID 2956 wrote to memory of 1676 2956 4480808.exe 44 PID 2956 wrote to memory of 1676 2956 4480808.exe 44 PID 2956 wrote to memory of 1676 2956 4480808.exe 44 PID 2956 wrote to memory of 1676 2956 4480808.exe 44 PID 1676 wrote to memory of 2064 1676 jdpvp.exe 45 PID 1676 wrote to memory of 2064 1676 jdpvp.exe 45 PID 1676 wrote to memory of 2064 1676 jdpvp.exe 45 PID 1676 wrote to memory of 2064 1676 jdpvp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\dca215016b4b0aa98faca380d505dc20655d7becd7b2834971d6874b37005cf6N.exe"C:\Users\Admin\AppData\Local\Temp\dca215016b4b0aa98faca380d505dc20655d7becd7b2834971d6874b37005cf6N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\206028.exec:\206028.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\bnbhbt.exec:\bnbhbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\rxrxrll.exec:\rxrxrll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\nhnbtb.exec:\nhnbtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\0424000.exec:\0424000.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\m6446.exec:\m6446.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\bthhth.exec:\bthhth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\tntbnt.exec:\tntbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\60284.exec:\60284.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\66608.exec:\66608.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\ttnbbt.exec:\ttnbbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\k44088.exec:\k44088.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\884084.exec:\884084.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\4480808.exec:\4480808.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\jdpvp.exec:\jdpvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\60246.exec:\60246.exe17⤵
- Executes dropped EXE
PID:2064 -
\??\c:\fllxrxx.exec:\fllxrxx.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2008 -
\??\c:\nhhbtb.exec:\nhhbtb.exe19⤵
- Executes dropped EXE
PID:2984 -
\??\c:\u442460.exec:\u442460.exe20⤵
- Executes dropped EXE
PID:896 -
\??\c:\4828286.exec:\4828286.exe21⤵
- Executes dropped EXE
PID:2148 -
\??\c:\djdpj.exec:\djdpj.exe22⤵
- Executes dropped EXE
PID:2584 -
\??\c:\btnbhh.exec:\btnbhh.exe23⤵
- Executes dropped EXE
PID:3044 -
\??\c:\llfrrfr.exec:\llfrrfr.exe24⤵
- Executes dropped EXE
PID:1232 -
\??\c:\3nhnth.exec:\3nhnth.exe25⤵
- Executes dropped EXE
PID:1680 -
\??\c:\ppvjd.exec:\ppvjd.exe26⤵
- Executes dropped EXE
PID:1904 -
\??\c:\62686.exec:\62686.exe27⤵
- Executes dropped EXE
PID:1636 -
\??\c:\o046848.exec:\o046848.exe28⤵
- Executes dropped EXE
PID:1992 -
\??\c:\9xxfrff.exec:\9xxfrff.exe29⤵
- Executes dropped EXE
PID:2464 -
\??\c:\888602.exec:\888602.exe30⤵
- Executes dropped EXE
PID:2508 -
\??\c:\48240.exec:\48240.exe31⤵
- Executes dropped EXE
PID:2080 -
\??\c:\5llflrr.exec:\5llflrr.exe32⤵
- Executes dropped EXE
PID:1936 -
\??\c:\i228286.exec:\i228286.exe33⤵
- Executes dropped EXE
PID:2084 -
\??\c:\8846406.exec:\8846406.exe34⤵
- Executes dropped EXE
PID:2560 -
\??\c:\q26240.exec:\q26240.exe35⤵
- Executes dropped EXE
PID:1968 -
\??\c:\flflrxl.exec:\flflrxl.exe36⤵
- Executes dropped EXE
PID:1552 -
\??\c:\flfflrl.exec:\flfflrl.exe37⤵
- Executes dropped EXE
PID:1700 -
\??\c:\tnbhth.exec:\tnbhth.exe38⤵
- Executes dropped EXE
PID:2572 -
\??\c:\rlfrrxr.exec:\rlfrrxr.exe39⤵
- Executes dropped EXE
PID:2904 -
\??\c:\a8868.exec:\a8868.exe40⤵
- Executes dropped EXE
PID:2848 -
\??\c:\048428.exec:\048428.exe41⤵
- Executes dropped EXE
PID:2876 -
\??\c:\u008020.exec:\u008020.exe42⤵
- Executes dropped EXE
PID:3024 -
\??\c:\jjdvd.exec:\jjdvd.exe43⤵
- Executes dropped EXE
PID:2808 -
\??\c:\48246.exec:\48246.exe44⤵
- Executes dropped EXE
PID:2856 -
\??\c:\6084002.exec:\6084002.exe45⤵
- Executes dropped EXE
PID:2768 -
\??\c:\1xrxlrx.exec:\1xrxlrx.exe46⤵
- Executes dropped EXE
PID:2604 -
\??\c:\dvjvp.exec:\dvjvp.exe47⤵
- Executes dropped EXE
PID:2488 -
\??\c:\022602.exec:\022602.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:668 -
\??\c:\2264286.exec:\2264286.exe49⤵
- Executes dropped EXE
PID:1080 -
\??\c:\i440468.exec:\i440468.exe50⤵
- Executes dropped EXE
PID:2948 -
\??\c:\ntnhbn.exec:\ntnhbn.exe51⤵
- Executes dropped EXE
PID:1724 -
\??\c:\6804068.exec:\6804068.exe52⤵
- Executes dropped EXE
PID:2780 -
\??\c:\6840668.exec:\6840668.exe53⤵
- Executes dropped EXE
PID:1944 -
\??\c:\00406.exec:\00406.exe54⤵
- Executes dropped EXE
PID:2960 -
\??\c:\04808.exec:\04808.exe55⤵
- Executes dropped EXE
PID:3004 -
\??\c:\xrlrfrr.exec:\xrlrfrr.exe56⤵
- Executes dropped EXE
PID:2964 -
\??\c:\42806.exec:\42806.exe57⤵
- Executes dropped EXE
PID:1604 -
\??\c:\482466.exec:\482466.exe58⤵
- Executes dropped EXE
PID:2368 -
\??\c:\jpvjd.exec:\jpvjd.exe59⤵
- Executes dropped EXE
PID:1388 -
\??\c:\22068.exec:\22068.exe60⤵
- Executes dropped EXE
PID:856 -
\??\c:\9vjdj.exec:\9vjdj.exe61⤵
- Executes dropped EXE
PID:2584 -
\??\c:\hbntbt.exec:\hbntbt.exe62⤵
- Executes dropped EXE
PID:1784 -
\??\c:\ppppj.exec:\ppppj.exe63⤵
- Executes dropped EXE
PID:1316 -
\??\c:\048422.exec:\048422.exe64⤵
- Executes dropped EXE
PID:1232 -
\??\c:\vdpvp.exec:\vdpvp.exe65⤵
- Executes dropped EXE
PID:2432 -
\??\c:\3jdjj.exec:\3jdjj.exe66⤵PID:1540
-
\??\c:\jddjj.exec:\jddjj.exe67⤵PID:1348
-
\??\c:\5pjjj.exec:\5pjjj.exe68⤵PID:760
-
\??\c:\nhthnt.exec:\nhthnt.exe69⤵PID:1652
-
\??\c:\jvjvd.exec:\jvjvd.exe70⤵PID:2464
-
\??\c:\82046.exec:\82046.exe71⤵PID:2388
-
\??\c:\9htnnh.exec:\9htnnh.exe72⤵PID:1156
-
\??\c:\ffxfllx.exec:\ffxfllx.exe73⤵PID:3020
-
\??\c:\jvjpj.exec:\jvjpj.exe74⤵PID:2032
-
\??\c:\lflrfrx.exec:\lflrfrx.exe75⤵PID:2396
-
\??\c:\7ppjp.exec:\7ppjp.exe76⤵PID:2400
-
\??\c:\3pvdp.exec:\3pvdp.exe77⤵PID:1684
-
\??\c:\pdjvd.exec:\pdjvd.exe78⤵PID:1968
-
\??\c:\s8684.exec:\s8684.exe79⤵PID:1420
-
\??\c:\nbttbh.exec:\nbttbh.exe80⤵PID:2412
-
\??\c:\3dddd.exec:\3dddd.exe81⤵PID:2016
-
\??\c:\0422806.exec:\0422806.exe82⤵PID:2832
-
\??\c:\bnbnbb.exec:\bnbnbb.exe83⤵PID:2868
-
\??\c:\e08468.exec:\e08468.exe84⤵PID:2896
-
\??\c:\4408204.exec:\4408204.exe85⤵PID:2932
-
\??\c:\s2624.exec:\s2624.exe86⤵PID:2648
-
\??\c:\xxllrlr.exec:\xxllrlr.exe87⤵PID:1908
-
\??\c:\pppvj.exec:\pppvj.exe88⤵PID:3012
-
\??\c:\2028286.exec:\2028286.exe89⤵PID:680
-
\??\c:\xlfrxfr.exec:\xlfrxfr.exe90⤵PID:1572
-
\??\c:\200646.exec:\200646.exe91⤵PID:1504
-
\??\c:\hnnnhh.exec:\hnnnhh.exe92⤵PID:1808
-
\??\c:\bbnnnb.exec:\bbnnnb.exe93⤵PID:2916
-
\??\c:\860028.exec:\860028.exe94⤵PID:1856
-
\??\c:\824064.exec:\824064.exe95⤵PID:2164
-
\??\c:\3dppj.exec:\3dppj.exe96⤵
- System Location Discovery: System Language Discovery
PID:1768 -
\??\c:\00884.exec:\00884.exe97⤵PID:1580
-
\??\c:\62006.exec:\62006.exe98⤵PID:2996
-
\??\c:\6040246.exec:\6040246.exe99⤵PID:2096
-
\??\c:\6088888.exec:\6088888.exe100⤵PID:2340
-
\??\c:\frrxxfx.exec:\frrxxfx.exe101⤵PID:2468
-
\??\c:\vpdpj.exec:\vpdpj.exe102⤵PID:560
-
\??\c:\tnhhtb.exec:\tnhhtb.exe103⤵PID:1672
-
\??\c:\tnhttb.exec:\tnhttb.exe104⤵PID:108
-
\??\c:\flflxlr.exec:\flflxlr.exe105⤵PID:1048
-
\??\c:\82026.exec:\82026.exe106⤵PID:2212
-
\??\c:\4828680.exec:\4828680.exe107⤵PID:872
-
\??\c:\448084.exec:\448084.exe108⤵PID:892
-
\??\c:\g0606.exec:\g0606.exe109⤵PID:1544
-
\??\c:\pdjvj.exec:\pdjvj.exe110⤵PID:2204
-
\??\c:\rrrffff.exec:\rrrffff.exe111⤵PID:1652
-
\??\c:\ttnntn.exec:\ttnntn.exe112⤵PID:2272
-
\??\c:\0220426.exec:\0220426.exe113⤵PID:2188
-
\??\c:\m4280.exec:\m4280.exe114⤵PID:1816
-
\??\c:\6800668.exec:\6800668.exe115⤵PID:2236
-
\??\c:\9nthbn.exec:\9nthbn.exe116⤵PID:2564
-
\??\c:\9dpdp.exec:\9dpdp.exe117⤵PID:2100
-
\??\c:\w86208.exec:\w86208.exe118⤵PID:2516
-
\??\c:\xfrllrf.exec:\xfrllrf.exe119⤵PID:2120
-
\??\c:\ttthtb.exec:\ttthtb.exe120⤵PID:1696
-
\??\c:\ffrfxlf.exec:\ffrfxlf.exe121⤵PID:2264
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-