Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
27-09-2024 10:03
Behavioral task
behavioral1
Sample
8bfd08851aebd2bd1679ad38faf41549d5a64f3609059e98b3c0bf7a6939767d.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
General
-
Target
8bfd08851aebd2bd1679ad38faf41549d5a64f3609059e98b3c0bf7a6939767d.exe
-
Size
330KB
-
MD5
6c4ada1795e75357f702f2a928d2e0a8
-
SHA1
90fe2ed5edbad8963d2a1052654a50f22aa430cd
-
SHA256
8bfd08851aebd2bd1679ad38faf41549d5a64f3609059e98b3c0bf7a6939767d
-
SHA512
51265d8abf61a3fd796b3a3f8e29b9e39fdb6966551f4e6a4451d8467892f8a8deb90e4d78a46afb19199df5a03b19cd595e2846180830d0178c90d40b6fed7f
-
SSDEEP
6144:vcm4FmowdHoStJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tv:94wFHoStJdSjylh2b77BoTMA9gX59sTH
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2884-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2040-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2208-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2208-63-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/560-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/560-72-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/944-82-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/944-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2140-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1768-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1768-110-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1768-109-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1232-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1860-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-159-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1752-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1948-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1740-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1992-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1184-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1484-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-390-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2828-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1936-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1700-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1740-515-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/560-616-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1232-670-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-15415-0x0000000077900000-0x0000000077A1F000-memory.dmp family_blackmoon behavioral1/memory/2448-15693-0x0000000077800000-0x00000000778FA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2868 3jdjp.exe 2900 hbnhnn.exe 2628 pjdvj.exe 2844 3flrflr.exe 2600 bbnnbb.exe 2040 jvpvv.exe 2208 xrlxflr.exe 560 xrxxxxf.exe 944 jvjjv.exe 2140 vpjjp.exe 2188 tnnthh.exe 1768 3dvjp.exe 1296 nttnbn.exe 2920 hbthnb.exe 1232 ddvvp.exe 1860 lfxxlrf.exe 2988 nhbhtt.exe 2584 rrlrrfx.exe 1752 tnbhnt.exe 1948 bthtbb.exe 2488 vpjpp.exe 2164 7rxlrxf.exe 1080 htnbhb.exe 1124 vpddj.exe 912 lflrffr.exe 1548 5bbbbt.exe 2004 jdddp.exe 600 xlllrll.exe 1740 hhbtth.exe 2228 vpjvd.exe 1992 llxrxxl.exe 1184 9bnnnn.exe 1820 djddp.exe 2364 fxflfxf.exe 2892 1frlrxx.exe 2452 bthnbb.exe 2736 5jjjv.exe 2868 ddjpd.exe 2984 rlffrxf.exe 2908 nhtthn.exe 2656 dvjpp.exe 2612 ppjpj.exe 2660 xxxlrxf.exe 2456 3nhhht.exe 476 ddvvp.exe 1484 dvdpv.exe 1472 7rrxlfx.exe 1340 nbttbb.exe 944 dvjvv.exe 2184 rllrflr.exe 2700 9lrrffl.exe 2788 thnntn.exe 2796 hbbnbb.exe 2828 5dpvp.exe 2980 vvvpv.exe 1936 lrllxxl.exe 1976 hnhbht.exe 2268 hnhtht.exe 1692 5vvvp.exe 1848 rlrlxxl.exe 1272 lxrxffl.exe 1956 9bbtnn.exe 2136 pdpjp.exe 2480 djdjj.exe -
resource yara_rule behavioral1/memory/2884-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000012286-5.dat upx behavioral1/memory/2884-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2868-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0011000000015d47-15.dat upx behavioral1/memory/2868-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015d5f-23.dat upx behavioral1/files/0x0008000000015d7f-30.dat upx behavioral1/files/0x0007000000015d8f-38.dat upx behavioral1/memory/2844-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2600-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d9c-47.dat upx behavioral1/memory/2040-53-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0007000000015dab-54.dat upx behavioral1/memory/2040-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2208-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015e4e-64.dat upx behavioral1/files/0x0007000000016c88-75.dat upx behavioral1/memory/560-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/944-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c9f-83.dat upx behavioral1/files/0x0006000000016caa-93.dat upx behavioral1/memory/2140-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cef-101.dat upx behavioral1/memory/2188-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d21-112.dat upx behavioral1/memory/1768-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d4b-119.dat upx behavioral1/files/0x0006000000016d67-127.dat upx behavioral1/memory/1232-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d6e-135.dat upx behavioral1/memory/1860-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d72-144.dat upx behavioral1/memory/2988-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d76-152.dat upx behavioral1/files/0x0006000000016d92-160.dat upx behavioral1/memory/1752-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2584-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1948-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016da7-169.dat upx behavioral1/memory/1948-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dbd-178.dat upx behavioral1/files/0x002f000000015d14-186.dat upx behavioral1/files/0x0006000000016dcf-194.dat upx behavioral1/memory/2164-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dd8-202.dat upx behavioral1/files/0x0006000000016de2-210.dat upx behavioral1/files/0x0006000000016dec-217.dat upx behavioral1/files/0x0006000000016df2-224.dat upx behavioral1/files/0x0006000000016df7-231.dat upx behavioral1/files/0x0006000000016dff-238.dat upx behavioral1/memory/1740-241-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001707e-246.dat upx behavioral1/files/0x00060000000170da-254.dat upx behavioral1/files/0x0006000000017226-262.dat upx behavioral1/memory/1992-261-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1184-269-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2452-291-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2736-297-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2656-318-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/476-340-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1484-347-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/944-358-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2796-384-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2868 2884 8bfd08851aebd2bd1679ad38faf41549d5a64f3609059e98b3c0bf7a6939767d.exe 30 PID 2884 wrote to memory of 2868 2884 8bfd08851aebd2bd1679ad38faf41549d5a64f3609059e98b3c0bf7a6939767d.exe 30 PID 2884 wrote to memory of 2868 2884 8bfd08851aebd2bd1679ad38faf41549d5a64f3609059e98b3c0bf7a6939767d.exe 30 PID 2884 wrote to memory of 2868 2884 8bfd08851aebd2bd1679ad38faf41549d5a64f3609059e98b3c0bf7a6939767d.exe 30 PID 2868 wrote to memory of 2900 2868 3jdjp.exe 31 PID 2868 wrote to memory of 2900 2868 3jdjp.exe 31 PID 2868 wrote to memory of 2900 2868 3jdjp.exe 31 PID 2868 wrote to memory of 2900 2868 3jdjp.exe 31 PID 2900 wrote to memory of 2628 2900 hbnhnn.exe 32 PID 2900 wrote to memory of 2628 2900 hbnhnn.exe 32 PID 2900 wrote to memory of 2628 2900 hbnhnn.exe 32 PID 2900 wrote to memory of 2628 2900 hbnhnn.exe 32 PID 2628 wrote to memory of 2844 2628 pjdvj.exe 33 PID 2628 wrote to memory of 2844 2628 pjdvj.exe 33 PID 2628 wrote to memory of 2844 2628 pjdvj.exe 33 PID 2628 wrote to memory of 2844 2628 pjdvj.exe 33 PID 2844 wrote to memory of 2600 2844 3flrflr.exe 34 PID 2844 wrote to memory of 2600 2844 3flrflr.exe 34 PID 2844 wrote to memory of 2600 2844 3flrflr.exe 34 PID 2844 wrote to memory of 2600 2844 3flrflr.exe 34 PID 2600 wrote to memory of 2040 2600 bbnnbb.exe 35 PID 2600 wrote to memory of 2040 2600 bbnnbb.exe 35 PID 2600 wrote to memory of 2040 2600 bbnnbb.exe 35 PID 2600 wrote to memory of 2040 2600 bbnnbb.exe 35 PID 2040 wrote to memory of 2208 2040 jvpvv.exe 36 PID 2040 wrote to memory of 2208 2040 jvpvv.exe 36 PID 2040 wrote to memory of 2208 2040 jvpvv.exe 36 PID 2040 wrote to memory of 2208 2040 jvpvv.exe 36 PID 2208 wrote to memory of 560 2208 xrlxflr.exe 37 PID 2208 wrote to memory of 560 2208 xrlxflr.exe 37 PID 2208 wrote to memory of 560 2208 xrlxflr.exe 37 PID 2208 wrote to memory of 560 2208 xrlxflr.exe 37 PID 560 wrote to memory of 944 560 xrxxxxf.exe 38 PID 560 wrote to memory of 944 560 xrxxxxf.exe 38 PID 560 wrote to memory of 944 560 xrxxxxf.exe 38 PID 560 wrote to memory of 944 560 xrxxxxf.exe 38 PID 944 wrote to memory of 2140 944 jvjjv.exe 39 PID 944 wrote to memory of 2140 944 jvjjv.exe 39 PID 944 wrote to memory of 2140 944 jvjjv.exe 39 PID 944 wrote to memory of 2140 944 jvjjv.exe 39 PID 2140 wrote to memory of 2188 2140 vpjjp.exe 40 PID 2140 wrote to memory of 2188 2140 vpjjp.exe 40 PID 2140 wrote to memory of 2188 2140 vpjjp.exe 40 PID 2140 wrote to memory of 2188 2140 vpjjp.exe 40 PID 2188 wrote to memory of 1768 2188 tnnthh.exe 41 PID 2188 wrote to memory of 1768 2188 tnnthh.exe 41 PID 2188 wrote to memory of 1768 2188 tnnthh.exe 41 PID 2188 wrote to memory of 1768 2188 tnnthh.exe 41 PID 1768 wrote to memory of 1296 1768 3dvjp.exe 42 PID 1768 wrote to memory of 1296 1768 3dvjp.exe 42 PID 1768 wrote to memory of 1296 1768 3dvjp.exe 42 PID 1768 wrote to memory of 1296 1768 3dvjp.exe 42 PID 1296 wrote to memory of 2920 1296 nttnbn.exe 43 PID 1296 wrote to memory of 2920 1296 nttnbn.exe 43 PID 1296 wrote to memory of 2920 1296 nttnbn.exe 43 PID 1296 wrote to memory of 2920 1296 nttnbn.exe 43 PID 2920 wrote to memory of 1232 2920 hbthnb.exe 44 PID 2920 wrote to memory of 1232 2920 hbthnb.exe 44 PID 2920 wrote to memory of 1232 2920 hbthnb.exe 44 PID 2920 wrote to memory of 1232 2920 hbthnb.exe 44 PID 1232 wrote to memory of 1860 1232 ddvvp.exe 45 PID 1232 wrote to memory of 1860 1232 ddvvp.exe 45 PID 1232 wrote to memory of 1860 1232 ddvvp.exe 45 PID 1232 wrote to memory of 1860 1232 ddvvp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8bfd08851aebd2bd1679ad38faf41549d5a64f3609059e98b3c0bf7a6939767d.exe"C:\Users\Admin\AppData\Local\Temp\8bfd08851aebd2bd1679ad38faf41549d5a64f3609059e98b3c0bf7a6939767d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\3jdjp.exec:\3jdjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\hbnhnn.exec:\hbnhnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\pjdvj.exec:\pjdvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\3flrflr.exec:\3flrflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\bbnnbb.exec:\bbnnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\jvpvv.exec:\jvpvv.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\xrlxflr.exec:\xrlxflr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\xrxxxxf.exec:\xrxxxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\jvjjv.exec:\jvjjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\vpjjp.exec:\vpjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\tnnthh.exec:\tnnthh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\3dvjp.exec:\3dvjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\nttnbn.exec:\nttnbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\hbthnb.exec:\hbthnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\ddvvp.exec:\ddvvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\lfxxlrf.exec:\lfxxlrf.exe17⤵
- Executes dropped EXE
PID:1860 -
\??\c:\nhbhtt.exec:\nhbhtt.exe18⤵
- Executes dropped EXE
PID:2988 -
\??\c:\rrlrrfx.exec:\rrlrrfx.exe19⤵
- Executes dropped EXE
PID:2584 -
\??\c:\tnbhnt.exec:\tnbhnt.exe20⤵
- Executes dropped EXE
PID:1752 -
\??\c:\bthtbb.exec:\bthtbb.exe21⤵
- Executes dropped EXE
PID:1948 -
\??\c:\vpjpp.exec:\vpjpp.exe22⤵
- Executes dropped EXE
PID:2488 -
\??\c:\7rxlrxf.exec:\7rxlrxf.exe23⤵
- Executes dropped EXE
PID:2164 -
\??\c:\htnbhb.exec:\htnbhb.exe24⤵
- Executes dropped EXE
PID:1080 -
\??\c:\vpddj.exec:\vpddj.exe25⤵
- Executes dropped EXE
PID:1124 -
\??\c:\lflrffr.exec:\lflrffr.exe26⤵
- Executes dropped EXE
PID:912 -
\??\c:\5bbbbt.exec:\5bbbbt.exe27⤵
- Executes dropped EXE
PID:1548 -
\??\c:\jdddp.exec:\jdddp.exe28⤵
- Executes dropped EXE
PID:2004 -
\??\c:\xlllrll.exec:\xlllrll.exe29⤵
- Executes dropped EXE
PID:600 -
\??\c:\hhbtth.exec:\hhbtth.exe30⤵
- Executes dropped EXE
PID:1740 -
\??\c:\vpjvd.exec:\vpjvd.exe31⤵
- Executes dropped EXE
PID:2228 -
\??\c:\llxrxxl.exec:\llxrxxl.exe32⤵
- Executes dropped EXE
PID:1992 -
\??\c:\9bnnnn.exec:\9bnnnn.exe33⤵
- Executes dropped EXE
PID:1184 -
\??\c:\djddp.exec:\djddp.exe34⤵
- Executes dropped EXE
PID:1820 -
\??\c:\fxflfxf.exec:\fxflfxf.exe35⤵
- Executes dropped EXE
PID:2364 -
\??\c:\1frlrxx.exec:\1frlrxx.exe36⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bthnbb.exec:\bthnbb.exe37⤵
- Executes dropped EXE
PID:2452 -
\??\c:\5jjjv.exec:\5jjjv.exe38⤵
- Executes dropped EXE
PID:2736 -
\??\c:\ddjpd.exec:\ddjpd.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\rlffrxf.exec:\rlffrxf.exe40⤵
- Executes dropped EXE
PID:2984 -
\??\c:\nhtthn.exec:\nhtthn.exe41⤵
- Executes dropped EXE
PID:2908 -
\??\c:\dvjpp.exec:\dvjpp.exe42⤵
- Executes dropped EXE
PID:2656 -
\??\c:\ppjpj.exec:\ppjpj.exe43⤵
- Executes dropped EXE
PID:2612 -
\??\c:\xxxlrxf.exec:\xxxlrxf.exe44⤵
- Executes dropped EXE
PID:2660 -
\??\c:\3nhhht.exec:\3nhhht.exe45⤵
- Executes dropped EXE
PID:2456 -
\??\c:\ddvvp.exec:\ddvvp.exe46⤵
- Executes dropped EXE
PID:476 -
\??\c:\dvdpv.exec:\dvdpv.exe47⤵
- Executes dropped EXE
PID:1484 -
\??\c:\7rrxlfx.exec:\7rrxlfx.exe48⤵
- Executes dropped EXE
PID:1472 -
\??\c:\nbttbb.exec:\nbttbb.exe49⤵
- Executes dropped EXE
PID:1340 -
\??\c:\dvjvv.exec:\dvjvv.exe50⤵
- Executes dropped EXE
PID:944 -
\??\c:\rllrflr.exec:\rllrflr.exe51⤵
- Executes dropped EXE
PID:2184 -
\??\c:\9lrrffl.exec:\9lrrffl.exe52⤵
- Executes dropped EXE
PID:2700 -
\??\c:\thnntn.exec:\thnntn.exe53⤵
- Executes dropped EXE
PID:2788 -
\??\c:\hbbnbb.exec:\hbbnbb.exe54⤵
- Executes dropped EXE
PID:2796 -
\??\c:\5dpvp.exec:\5dpvp.exe55⤵
- Executes dropped EXE
PID:2828 -
\??\c:\vvvpv.exec:\vvvpv.exe56⤵
- Executes dropped EXE
PID:2980 -
\??\c:\lrllxxl.exec:\lrllxxl.exe57⤵
- Executes dropped EXE
PID:1936 -
\??\c:\hnhbht.exec:\hnhbht.exe58⤵
- Executes dropped EXE
PID:1976 -
\??\c:\hnhtht.exec:\hnhtht.exe59⤵
- Executes dropped EXE
PID:2268 -
\??\c:\5vvvp.exec:\5vvvp.exe60⤵
- Executes dropped EXE
PID:1692 -
\??\c:\rlrlxxl.exec:\rlrlxxl.exe61⤵
- Executes dropped EXE
PID:1848 -
\??\c:\lxrxffl.exec:\lxrxffl.exe62⤵
- Executes dropped EXE
PID:1272 -
\??\c:\9bbtnn.exec:\9bbtnn.exe63⤵
- Executes dropped EXE
PID:1956 -
\??\c:\pdpjp.exec:\pdpjp.exe64⤵
- Executes dropped EXE
PID:2136 -
\??\c:\djdjj.exec:\djdjj.exe65⤵
- Executes dropped EXE
PID:2480 -
\??\c:\lxxffll.exec:\lxxffll.exe66⤵PID:2468
-
\??\c:\hbnhtb.exec:\hbnhtb.exe67⤵PID:2152
-
\??\c:\htnnnh.exec:\htnnnh.exe68⤵PID:2104
-
\??\c:\pdjdp.exec:\pdjdp.exe69⤵PID:1356
-
\??\c:\3rffxff.exec:\3rffxff.exe70⤵PID:2340
-
\??\c:\7lfllrx.exec:\7lfllrx.exe71⤵PID:2500
-
\??\c:\3hthtb.exec:\3hthtb.exe72⤵PID:2536
-
\??\c:\ppdpp.exec:\ppdpp.exe73⤵PID:2552
-
\??\c:\5ddjv.exec:\5ddjv.exe74⤵PID:876
-
\??\c:\xrfxxxf.exec:\xrfxxxf.exe75⤵PID:1724
-
\??\c:\3rlrxff.exec:\3rlrxff.exe76⤵PID:1700
-
\??\c:\thttbh.exec:\thttbh.exe77⤵PID:1740
-
\??\c:\5hbhhn.exec:\5hbhhn.exe78⤵PID:2524
-
\??\c:\dvvvv.exec:\dvvvv.exe79⤵PID:2544
-
\??\c:\lxfffxx.exec:\lxfffxx.exe80⤵PID:896
-
\??\c:\7xrllll.exec:\7xrllll.exe81⤵PID:1648
-
\??\c:\bthhbh.exec:\bthhbh.exe82⤵PID:2400
-
\??\c:\bttbbb.exec:\bttbbb.exe83⤵PID:2364
-
\??\c:\vpddd.exec:\vpddd.exe84⤵PID:1592
-
\??\c:\lrfflrx.exec:\lrfflrx.exe85⤵PID:2212
-
\??\c:\1llxflr.exec:\1llxflr.exe86⤵PID:2636
-
\??\c:\hthntb.exec:\hthntb.exe87⤵PID:1808
-
\??\c:\thttbb.exec:\thttbb.exe88⤵PID:1792
-
\??\c:\dvddp.exec:\dvddp.exe89⤵PID:2768
-
\??\c:\xrflrxr.exec:\xrflrxr.exe90⤵PID:2600
-
\??\c:\7frlxxx.exec:\7frlxxx.exe91⤵PID:2680
-
\??\c:\5nhnbt.exec:\5nhnbt.exe92⤵PID:2644
-
\??\c:\pdvdj.exec:\pdvdj.exe93⤵PID:2208
-
\??\c:\5dpvv.exec:\5dpvv.exe94⤵PID:764
-
\??\c:\lfxrxrx.exec:\lfxrxrx.exe95⤵PID:560
-
\??\c:\bbnhnh.exec:\bbnhnh.exe96⤵PID:1472
-
\??\c:\nbttbb.exec:\nbttbb.exe97⤵PID:1340
-
\??\c:\vdjjj.exec:\vdjjj.exe98⤵PID:2140
-
\??\c:\fxrfllr.exec:\fxrfllr.exe99⤵PID:2296
-
\??\c:\7rffxlf.exec:\7rffxlf.exe100⤵PID:2832
-
\??\c:\bbnbhn.exec:\bbnbhn.exe101⤵PID:1768
-
\??\c:\1tbbtb.exec:\1tbbtb.exe102⤵PID:1296
-
\??\c:\jdpvd.exec:\jdpvd.exe103⤵PID:2692
-
\??\c:\dvvjd.exec:\dvvjd.exe104⤵PID:2980
-
\??\c:\xrfflrr.exec:\xrfflrr.exe105⤵PID:1936
-
\??\c:\bthnnt.exec:\bthnnt.exe106⤵PID:1232
-
\??\c:\hhtnnt.exec:\hhtnnt.exe107⤵PID:2268
-
\??\c:\djpjj.exec:\djpjj.exe108⤵PID:1692
-
\??\c:\5lrlffx.exec:\5lrlffx.exe109⤵PID:1848
-
\??\c:\lxxfxff.exec:\lxxfxff.exe110⤵PID:112
-
\??\c:\7htnnh.exec:\7htnnh.exe111⤵PID:1956
-
\??\c:\9nhnnn.exec:\9nhnnn.exe112⤵PID:2244
-
\??\c:\dvddp.exec:\dvddp.exe113⤵PID:2224
-
\??\c:\xlxrrrf.exec:\xlxrrrf.exe114⤵PID:2468
-
\??\c:\lrlxfll.exec:\lrlxfll.exe115⤵PID:2200
-
\??\c:\btnthn.exec:\btnthn.exe116⤵PID:2164
-
\??\c:\pjvvd.exec:\pjvvd.exe117⤵PID:1556
-
\??\c:\dvjjd.exec:\dvjjd.exe118⤵PID:1968
-
\??\c:\rfrrrlr.exec:\rfrrrlr.exe119⤵PID:2500
-
\??\c:\rlxxxrx.exec:\rlxxxrx.exe120⤵PID:912
-
\??\c:\hhbbnt.exec:\hhbbnt.exe121⤵PID:2004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-