Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-10-2024 08:47
Behavioral task
behavioral1
Sample
7a558039508dd74926e0d353f250b74746a08be59b85f08f5babfa97b43adc92N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
7a558039508dd74926e0d353f250b74746a08be59b85f08f5babfa97b43adc92N.exe
-
Size
454KB
-
MD5
a91b9ca39012ba1c8cce4b248e5e9240
-
SHA1
c13892b092fada4d0b4ab25d5d208948d842fd16
-
SHA256
7a558039508dd74926e0d353f250b74746a08be59b85f08f5babfa97b43adc92
-
SHA512
2733da6247522a6770a563a997480e68049f81befa61a35c61306bac09d9ac9dd0dd726ccefba432a04a2ef8c3426f1b740ade4383edaf447316ae03732b32e6
-
SSDEEP
12288:04wFHoSyd0V3eFp3IDvSbh5nPYERM8mXzploE:rd0gFp3lz1/uzploE
Malware Config
Signatures
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2192-10-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/3004-7-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2672-36-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2308-44-0x00000000002D0000-0x0000000000308000-memory.dmp family_blackmoon behavioral1/memory/2308-46-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2796-55-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2316-73-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2696-65-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2616-84-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2704-93-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2668-101-0x00000000001B0000-0x00000000001E8000-memory.dmp family_blackmoon behavioral1/memory/2668-103-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2128-112-0x00000000001B0000-0x00000000001E8000-memory.dmp family_blackmoon behavioral1/memory/2128-111-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2652-138-0x0000000000220000-0x0000000000258000-memory.dmp family_blackmoon behavioral1/memory/792-147-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/568-157-0x0000000000220000-0x0000000000258000-memory.dmp family_blackmoon behavioral1/memory/568-159-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1012-167-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2900-179-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2900-177-0x0000000001C60000-0x0000000001C98000-memory.dmp family_blackmoon behavioral1/memory/568-189-0x0000000000220000-0x0000000000258000-memory.dmp family_blackmoon behavioral1/memory/824-188-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2328-197-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1072-200-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1292-211-0x0000000000220000-0x0000000000258000-memory.dmp family_blackmoon behavioral1/memory/1712-232-0x0000000001C80000-0x0000000001CB8000-memory.dmp family_blackmoon behavioral1/memory/1248-236-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1712-234-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2052-254-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/864-251-0x0000000000540000-0x0000000000578000-memory.dmp family_blackmoon behavioral1/memory/1408-270-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/868-278-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1424-287-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2096-298-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2524-308-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2780-326-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2848-351-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2968-358-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/620-427-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1224-485-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1964-497-0x00000000003A0000-0x00000000003D8000-memory.dmp family_blackmoon behavioral1/memory/2256-522-0x00000000001B0000-0x00000000001E8000-memory.dmp family_blackmoon behavioral1/memory/2620-635-0x0000000000220000-0x0000000000258000-memory.dmp family_blackmoon behavioral1/memory/1896-650-0x0000000000220000-0x0000000000258000-memory.dmp family_blackmoon behavioral1/memory/1352-679-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2460-940-0x0000000000220000-0x0000000000258000-memory.dmp family_blackmoon behavioral1/memory/1404-968-0x0000000000440000-0x0000000000478000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2192 lxllxxf.exe 2092 fxlxrfr.exe 2672 3dvvv.exe 2308 nthbbt.exe 2796 xrffxxl.exe 2696 bhthbn.exe 2316 pdvvd.exe 2616 btnhnt.exe 2704 bthhhh.exe 2668 1pjjd.exe 2128 bthhnn.exe 576 vddvp.exe 1708 nbnttt.exe 2652 jpvjd.exe 792 7tnbnb.exe 568 nhtbtt.exe 1012 jjdvd.exe 2900 1pjpd.exe 824 nhttbb.exe 2328 1dpdp.exe 1072 nttnbh.exe 1292 dvvpd.exe 2008 5fxxffl.exe 1712 7djjv.exe 1248 nbttbb.exe 864 dvpvj.exe 2052 3lflrxf.exe 1408 ffxlxxl.exe 868 bthbhn.exe 1424 xrlrffl.exe 2096 djvpd.exe 1976 9rxxxxf.exe 2524 3tbnhb.exe 2540 jjdpd.exe 2780 lxfxffr.exe 2672 bthnnn.exe 2784 hbntbn.exe 2820 dpdvj.exe 2848 rxxflrl.exe 2968 3btbhn.exe 2600 hbtntb.exe 2884 7djdd.exe 2636 rxxlxxr.exe 2664 hbbbnt.exe 2644 3nnntt.exe 664 ppjdj.exe 1400 llxfrxl.exe 2032 9hbbbt.exe 2116 hhtbhh.exe 1620 1jppj.exe 620 fflxllf.exe 1844 nhttbh.exe 1020 bthhhb.exe 1556 jpdpv.exe 1688 7xrflxf.exe 2908 9rlxflf.exe 492 bhbtht.exe 2220 jjvdp.exe 2276 1rlxfrf.exe 1224 xflfffl.exe 924 hthhnn.exe 1964 jdpvd.exe 1548 rrrrflf.exe 1940 fxffllr.exe -
resource yara_rule behavioral1/memory/3004-0-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x000d0000000122e4-5.dat upx behavioral1/memory/2192-10-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/3004-7-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x0008000000016d58-17.dat upx behavioral1/files/0x0007000000016db5-27.dat upx behavioral1/memory/2672-36-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x0007000000016dd0-35.dat upx behavioral1/memory/2308-46-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x0007000000016de4-45.dat upx behavioral1/files/0x0009000000016de8-56.dat upx behavioral1/memory/2796-55-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2796-47-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x0006000000018697-74.dat upx behavioral1/memory/2316-73-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x0009000000016eb8-66.dat upx behavioral1/memory/2696-65-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x00050000000187a2-83.dat upx behavioral1/memory/2616-84-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x0006000000018c34-92.dat upx behavioral1/memory/2704-93-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2668-103-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x0006000000018c44-102.dat upx behavioral1/files/0x0006000000018f65-113.dat upx behavioral1/memory/2128-111-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x000600000001904c-122.dat upx behavioral1/files/0x00060000000190e1-130.dat upx behavioral1/files/0x0009000000016d36-140.dat upx behavioral1/files/0x00050000000191d2-149.dat upx behavioral1/memory/792-147-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/568-159-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x00050000000191f6-158.dat upx behavioral1/memory/568-155-0x0000000000220000-0x0000000000258000-memory.dmp upx behavioral1/files/0x0005000000019217-168.dat upx behavioral1/memory/1012-167-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2900-179-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x0005000000019240-178.dat upx behavioral1/memory/824-188-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x0005000000019259-187.dat upx behavioral1/memory/2328-197-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x0005000000019268-199.dat upx behavioral1/memory/1072-200-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x000500000001926c-207.dat upx behavioral1/files/0x0005000000019275-216.dat upx behavioral1/files/0x0005000000019278-224.dat upx behavioral1/files/0x000500000001929a-235.dat upx behavioral1/memory/1248-236-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/1712-234-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x0005000000019319-244.dat upx behavioral1/files/0x0005000000019365-253.dat upx behavioral1/memory/2052-254-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x0005000000019377-261.dat upx behavioral1/memory/1408-270-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x0005000000019387-269.dat upx behavioral1/memory/868-278-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x00050000000193a4-279.dat upx behavioral1/memory/1424-287-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/files/0x00050000000193b3-288.dat upx behavioral1/files/0x00050000000193c1-296.dat upx behavioral1/memory/2096-298-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2524-308-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2780-326-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2848-351-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2968-358-0x0000000000400000-0x0000000000438000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlflfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlffffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2192 3004 7a558039508dd74926e0d353f250b74746a08be59b85f08f5babfa97b43adc92N.exe 30 PID 3004 wrote to memory of 2192 3004 7a558039508dd74926e0d353f250b74746a08be59b85f08f5babfa97b43adc92N.exe 30 PID 3004 wrote to memory of 2192 3004 7a558039508dd74926e0d353f250b74746a08be59b85f08f5babfa97b43adc92N.exe 30 PID 3004 wrote to memory of 2192 3004 7a558039508dd74926e0d353f250b74746a08be59b85f08f5babfa97b43adc92N.exe 30 PID 2192 wrote to memory of 2092 2192 lxllxxf.exe 31 PID 2192 wrote to memory of 2092 2192 lxllxxf.exe 31 PID 2192 wrote to memory of 2092 2192 lxllxxf.exe 31 PID 2192 wrote to memory of 2092 2192 lxllxxf.exe 31 PID 2092 wrote to memory of 2672 2092 fxlxrfr.exe 32 PID 2092 wrote to memory of 2672 2092 fxlxrfr.exe 32 PID 2092 wrote to memory of 2672 2092 fxlxrfr.exe 32 PID 2092 wrote to memory of 2672 2092 fxlxrfr.exe 32 PID 2672 wrote to memory of 2308 2672 3dvvv.exe 33 PID 2672 wrote to memory of 2308 2672 3dvvv.exe 33 PID 2672 wrote to memory of 2308 2672 3dvvv.exe 33 PID 2672 wrote to memory of 2308 2672 3dvvv.exe 33 PID 2308 wrote to memory of 2796 2308 nthbbt.exe 34 PID 2308 wrote to memory of 2796 2308 nthbbt.exe 34 PID 2308 wrote to memory of 2796 2308 nthbbt.exe 34 PID 2308 wrote to memory of 2796 2308 nthbbt.exe 34 PID 2796 wrote to memory of 2696 2796 xrffxxl.exe 35 PID 2796 wrote to memory of 2696 2796 xrffxxl.exe 35 PID 2796 wrote to memory of 2696 2796 xrffxxl.exe 35 PID 2796 wrote to memory of 2696 2796 xrffxxl.exe 35 PID 2696 wrote to memory of 2316 2696 bhthbn.exe 36 PID 2696 wrote to memory of 2316 2696 bhthbn.exe 36 PID 2696 wrote to memory of 2316 2696 bhthbn.exe 36 PID 2696 wrote to memory of 2316 2696 bhthbn.exe 36 PID 2316 wrote to memory of 2616 2316 pdvvd.exe 37 PID 2316 wrote to memory of 2616 2316 pdvvd.exe 37 PID 2316 wrote to memory of 2616 2316 pdvvd.exe 37 PID 2316 wrote to memory of 2616 2316 pdvvd.exe 37 PID 2616 wrote to memory of 2704 2616 btnhnt.exe 38 PID 2616 wrote to memory of 2704 2616 btnhnt.exe 38 PID 2616 wrote to memory of 2704 2616 btnhnt.exe 38 PID 2616 wrote to memory of 2704 2616 btnhnt.exe 38 PID 2704 wrote to memory of 2668 2704 bthhhh.exe 39 PID 2704 wrote to memory of 2668 2704 bthhhh.exe 39 PID 2704 wrote to memory of 2668 2704 bthhhh.exe 39 PID 2704 wrote to memory of 2668 2704 bthhhh.exe 39 PID 2668 wrote to memory of 2128 2668 1pjjd.exe 40 PID 2668 wrote to memory of 2128 2668 1pjjd.exe 40 PID 2668 wrote to memory of 2128 2668 1pjjd.exe 40 PID 2668 wrote to memory of 2128 2668 1pjjd.exe 40 PID 2128 wrote to memory of 576 2128 bthhnn.exe 41 PID 2128 wrote to memory of 576 2128 bthhnn.exe 41 PID 2128 wrote to memory of 576 2128 bthhnn.exe 41 PID 2128 wrote to memory of 576 2128 bthhnn.exe 41 PID 576 wrote to memory of 1708 576 vddvp.exe 42 PID 576 wrote to memory of 1708 576 vddvp.exe 42 PID 576 wrote to memory of 1708 576 vddvp.exe 42 PID 576 wrote to memory of 1708 576 vddvp.exe 42 PID 1708 wrote to memory of 2652 1708 nbnttt.exe 43 PID 1708 wrote to memory of 2652 1708 nbnttt.exe 43 PID 1708 wrote to memory of 2652 1708 nbnttt.exe 43 PID 1708 wrote to memory of 2652 1708 nbnttt.exe 43 PID 2652 wrote to memory of 792 2652 jpvjd.exe 44 PID 2652 wrote to memory of 792 2652 jpvjd.exe 44 PID 2652 wrote to memory of 792 2652 jpvjd.exe 44 PID 2652 wrote to memory of 792 2652 jpvjd.exe 44 PID 792 wrote to memory of 568 792 7tnbnb.exe 45 PID 792 wrote to memory of 568 792 7tnbnb.exe 45 PID 792 wrote to memory of 568 792 7tnbnb.exe 45 PID 792 wrote to memory of 568 792 7tnbnb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a558039508dd74926e0d353f250b74746a08be59b85f08f5babfa97b43adc92N.exe"C:\Users\Admin\AppData\Local\Temp\7a558039508dd74926e0d353f250b74746a08be59b85f08f5babfa97b43adc92N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\lxllxxf.exec:\lxllxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\fxlxrfr.exec:\fxlxrfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\3dvvv.exec:\3dvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\nthbbt.exec:\nthbbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\xrffxxl.exec:\xrffxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\bhthbn.exec:\bhthbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\pdvvd.exec:\pdvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\btnhnt.exec:\btnhnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\bthhhh.exec:\bthhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\1pjjd.exec:\1pjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\bthhnn.exec:\bthhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\vddvp.exec:\vddvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\nbnttt.exec:\nbnttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\jpvjd.exec:\jpvjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\7tnbnb.exec:\7tnbnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\nhtbtt.exec:\nhtbtt.exe17⤵
- Executes dropped EXE
PID:568 -
\??\c:\jjdvd.exec:\jjdvd.exe18⤵
- Executes dropped EXE
PID:1012 -
\??\c:\1pjpd.exec:\1pjpd.exe19⤵
- Executes dropped EXE
PID:2900 -
\??\c:\nhttbb.exec:\nhttbb.exe20⤵
- Executes dropped EXE
PID:824 -
\??\c:\1dpdp.exec:\1dpdp.exe21⤵
- Executes dropped EXE
PID:2328 -
\??\c:\nttnbh.exec:\nttnbh.exe22⤵
- Executes dropped EXE
PID:1072 -
\??\c:\dvvpd.exec:\dvvpd.exe23⤵
- Executes dropped EXE
PID:1292 -
\??\c:\5fxxffl.exec:\5fxxffl.exe24⤵
- Executes dropped EXE
PID:2008 -
\??\c:\7djjv.exec:\7djjv.exe25⤵
- Executes dropped EXE
PID:1712 -
\??\c:\nbttbb.exec:\nbttbb.exe26⤵
- Executes dropped EXE
PID:1248 -
\??\c:\dvpvj.exec:\dvpvj.exe27⤵
- Executes dropped EXE
PID:864 -
\??\c:\3lflrxf.exec:\3lflrxf.exe28⤵
- Executes dropped EXE
PID:2052 -
\??\c:\ffxlxxl.exec:\ffxlxxl.exe29⤵
- Executes dropped EXE
PID:1408 -
\??\c:\bthbhn.exec:\bthbhn.exe30⤵
- Executes dropped EXE
PID:868 -
\??\c:\xrlrffl.exec:\xrlrffl.exe31⤵
- Executes dropped EXE
PID:1424 -
\??\c:\djvpd.exec:\djvpd.exe32⤵
- Executes dropped EXE
PID:2096 -
\??\c:\9rxxxxf.exec:\9rxxxxf.exe33⤵
- Executes dropped EXE
PID:1976 -
\??\c:\3tbnhb.exec:\3tbnhb.exe34⤵
- Executes dropped EXE
PID:2524 -
\??\c:\jjdpd.exec:\jjdpd.exe35⤵
- Executes dropped EXE
PID:2540 -
\??\c:\lxfxffr.exec:\lxfxffr.exe36⤵
- Executes dropped EXE
PID:2780 -
\??\c:\bthnnn.exec:\bthnnn.exe37⤵
- Executes dropped EXE
PID:2672 -
\??\c:\hbntbn.exec:\hbntbn.exe38⤵
- Executes dropped EXE
PID:2784 -
\??\c:\dpdvj.exec:\dpdvj.exe39⤵
- Executes dropped EXE
PID:2820 -
\??\c:\rxxflrl.exec:\rxxflrl.exe40⤵
- Executes dropped EXE
PID:2848 -
\??\c:\3btbhn.exec:\3btbhn.exe41⤵
- Executes dropped EXE
PID:2968 -
\??\c:\hbtntb.exec:\hbtntb.exe42⤵
- Executes dropped EXE
PID:2600 -
\??\c:\7djdd.exec:\7djdd.exe43⤵
- Executes dropped EXE
PID:2884 -
\??\c:\rxxlxxr.exec:\rxxlxxr.exe44⤵
- Executes dropped EXE
PID:2636 -
\??\c:\hbbbnt.exec:\hbbbnt.exe45⤵
- Executes dropped EXE
PID:2664 -
\??\c:\3nnntt.exec:\3nnntt.exe46⤵
- Executes dropped EXE
PID:2644 -
\??\c:\ppjdj.exec:\ppjdj.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:664 -
\??\c:\llxfrxl.exec:\llxfrxl.exe48⤵
- Executes dropped EXE
PID:1400 -
\??\c:\9hbbbt.exec:\9hbbbt.exe49⤵
- Executes dropped EXE
PID:2032 -
\??\c:\hhtbhh.exec:\hhtbhh.exe50⤵
- Executes dropped EXE
PID:2116 -
\??\c:\1jppj.exec:\1jppj.exe51⤵
- Executes dropped EXE
PID:1620 -
\??\c:\fflxllf.exec:\fflxllf.exe52⤵
- Executes dropped EXE
PID:620 -
\??\c:\nhttbh.exec:\nhttbh.exe53⤵
- Executes dropped EXE
PID:1844 -
\??\c:\bthhhb.exec:\bthhhb.exe54⤵
- Executes dropped EXE
PID:1020 -
\??\c:\jpdpv.exec:\jpdpv.exe55⤵
- Executes dropped EXE
PID:1556 -
\??\c:\7xrflxf.exec:\7xrflxf.exe56⤵
- Executes dropped EXE
PID:1688 -
\??\c:\9rlxflf.exec:\9rlxflf.exe57⤵
- Executes dropped EXE
PID:2908 -
\??\c:\bhbtht.exec:\bhbtht.exe58⤵
- Executes dropped EXE
PID:492 -
\??\c:\jjvdp.exec:\jjvdp.exe59⤵
- Executes dropped EXE
PID:2220 -
\??\c:\1rlxfrf.exec:\1rlxfrf.exe60⤵
- Executes dropped EXE
PID:2276 -
\??\c:\xflfffl.exec:\xflfffl.exe61⤵
- Executes dropped EXE
PID:1224 -
\??\c:\hthhnn.exec:\hthhnn.exe62⤵
- Executes dropped EXE
PID:924 -
\??\c:\jdpvd.exec:\jdpvd.exe63⤵
- Executes dropped EXE
PID:1964 -
\??\c:\rrrrflf.exec:\rrrrflf.exe64⤵
- Executes dropped EXE
PID:1548 -
\??\c:\fxffllr.exec:\fxffllr.exe65⤵
- Executes dropped EXE
PID:1940 -
\??\c:\9tnttt.exec:\9tnttt.exe66⤵PID:1468
-
\??\c:\dpvvv.exec:\dpvvv.exe67⤵PID:2256
-
\??\c:\xxxxlxl.exec:\xxxxlxl.exe68⤵PID:2140
-
\??\c:\3xlxxxl.exec:\3xlxxxl.exe69⤵PID:1912
-
\??\c:\hnhthn.exec:\hnhthn.exe70⤵PID:1680
-
\??\c:\pdppv.exec:\pdppv.exe71⤵PID:2148
-
\??\c:\jdjdp.exec:\jdjdp.exe72⤵PID:676
-
\??\c:\lfrxxxl.exec:\lfrxxxl.exe73⤵PID:1524
-
\??\c:\hbntbt.exec:\hbntbt.exe74⤵PID:832
-
\??\c:\jddpp.exec:\jddpp.exe75⤵PID:1636
-
\??\c:\jjjvj.exec:\jjjvj.exe76⤵PID:1728
-
\??\c:\fxxlxlf.exec:\fxxlxlf.exe77⤵PID:2404
-
\??\c:\3htthh.exec:\3htthh.exe78⤵PID:2676
-
\??\c:\tttbht.exec:\tttbht.exe79⤵PID:2504
-
\??\c:\ddpdp.exec:\ddpdp.exe80⤵PID:2452
-
\??\c:\1xxlfrl.exec:\1xxlfrl.exe81⤵PID:2740
-
\??\c:\3bntbn.exec:\3bntbn.exe82⤵PID:2808
-
\??\c:\tbbhht.exec:\tbbhht.exe83⤵PID:2832
-
\??\c:\ppjjj.exec:\ppjjj.exe84⤵PID:2724
-
\??\c:\xxxfxfx.exec:\xxxfxfx.exe85⤵PID:2620
-
\??\c:\nnhnbb.exec:\nnhnbb.exe86⤵PID:2852
-
\??\c:\ppjdp.exec:\ppjdp.exe87⤵PID:2608
-
\??\c:\djjjp.exec:\djjjp.exe88⤵PID:1896
-
\??\c:\xrlfxfr.exec:\xrlfxfr.exe89⤵PID:2656
-
\??\c:\nnhnht.exec:\nnhnht.exe90⤵PID:2300
-
\??\c:\3dpvv.exec:\3dpvv.exe91⤵PID:1432
-
\??\c:\7jdjp.exec:\7jdjp.exe92⤵PID:1352
-
\??\c:\rxfxxxx.exec:\rxfxxxx.exe93⤵PID:1864
-
\??\c:\nhbnht.exec:\nhbnht.exe94⤵
- System Location Discovery: System Language Discovery
PID:1992 -
\??\c:\jdvjd.exec:\jdvjd.exe95⤵PID:1996
-
\??\c:\fxxxllf.exec:\fxxxllf.exe96⤵PID:620
-
\??\c:\lflflrf.exec:\lflflrf.exe97⤵PID:1540
-
\??\c:\bnntnb.exec:\bnntnb.exe98⤵PID:236
-
\??\c:\pjvdj.exec:\pjvdj.exe99⤵PID:2912
-
\??\c:\7llfrfr.exec:\7llfrfr.exe100⤵PID:1012
-
\??\c:\lfxlxfx.exec:\lfxlxfx.exe101⤵PID:1004
-
\??\c:\bhhbtn.exec:\bhhbtn.exe102⤵PID:2284
-
\??\c:\jvdvp.exec:\jvdvp.exe103⤵PID:2200
-
\??\c:\xrrfxfx.exec:\xrrfxfx.exe104⤵PID:2352
-
\??\c:\hhnbnt.exec:\hhnbnt.exe105⤵PID:1072
-
\??\c:\bbnhnt.exec:\bbnhnt.exe106⤵PID:1296
-
\??\c:\ppjvp.exec:\ppjvp.exe107⤵PID:2224
-
\??\c:\xfxrfll.exec:\xfxrfll.exe108⤵PID:1916
-
\??\c:\tbbhbn.exec:\tbbhbn.exe109⤵PID:1788
-
\??\c:\3bbbtb.exec:\3bbbtb.exe110⤵PID:1672
-
\??\c:\dddpd.exec:\dddpd.exe111⤵PID:896
-
\??\c:\3llxxlx.exec:\3llxxlx.exe112⤵PID:2288
-
\??\c:\1tnthn.exec:\1tnthn.exe113⤵PID:2448
-
\??\c:\vpjvv.exec:\vpjvv.exe114⤵PID:2228
-
\??\c:\llffrfr.exec:\llffrfr.exe115⤵PID:1408
-
\??\c:\bbhnhh.exec:\bbhnhh.exe116⤵PID:1188
-
\??\c:\7dvjd.exec:\7dvjd.exe117⤵PID:872
-
\??\c:\lfxxflf.exec:\lfxxflf.exe118⤵PID:3008
-
\??\c:\bbbhnt.exec:\bbbhnt.exe119⤵PID:1516
-
\??\c:\pjvdv.exec:\pjvdv.exe120⤵PID:1932
-
\??\c:\jdpdd.exec:\jdpdd.exe121⤵PID:1496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-