Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/11/2024, 17:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a965bcba7eb971d51a453d687e166d006cd539b77645b6f5a32e1f073d9c8c07.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a965bcba7eb971d51a453d687e166d006cd539b77645b6f5a32e1f073d9c8c07.exe
-
Size
456KB
-
MD5
9a2ea23315f59799aa41ac45b0425324
-
SHA1
f18b3777e1deeaf819c24ac83c658c237be2e7d7
-
SHA256
a965bcba7eb971d51a453d687e166d006cd539b77645b6f5a32e1f073d9c8c07
-
SHA512
0a05f000cce59e82e915a986aa727c97837d820c431938cfe956c97535a64a3bb55be996ba702f6bbf0363f059dc8921e14ae9cae044112006ec41566d8b37b1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRe:q7Tc2NYHUrAwfMp3CDRe
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2336-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-46-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2732-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-126-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1452-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-230-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/788-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/340-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-359-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3000-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-530-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1676-564-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2504-712-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/108-824-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2804-947-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1900-954-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1724-995-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-1036-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/580-1110-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2360-1131-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1752-1275-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1752-1279-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2508 rrrxfll.exe 1992 ntnnbh.exe 3056 tnnnbb.exe 2980 ppdpv.exe 2732 9nbhbn.exe 2636 djdpj.exe 2664 ppppd.exe 2872 xrffrff.exe 2696 vpjvj.exe 2564 nnbtbt.exe 2584 rllrrxl.exe 2916 nnhtnt.exe 2504 tbtbtt.exe 1452 rxlfllr.exe 2720 pvjvj.exe 1728 7fxrllr.exe 1756 jjddd.exe 2952 lxrfrfr.exe 2260 vpdpp.exe 2020 lrrffrr.exe 1540 pjvdp.exe 2136 xxxffxl.exe 2056 dddpd.exe 1308 7ntbnb.exe 2400 ddpjv.exe 852 hhbnht.exe 1488 ffxrlxl.exe 2172 vdvpd.exe 580 9rflrrf.exe 788 tnbnbb.exe 2128 xrxxllx.exe 884 pjpvv.exe 592 rrlrfxx.exe 1552 ttbbhb.exe 1944 jpjjp.exe 2460 9btbtb.exe 1260 ppvpv.exe 340 xfrfxll.exe 2000 htnntt.exe 2676 pdjjp.exe 2640 xrxllrr.exe 3000 fffrflx.exe 2848 nbhbbb.exe 2620 1rffxxl.exe 2872 nbtnht.exe 2544 jjvvd.exe 1864 rrrrrll.exe 2564 nbnttt.exe 688 vvjdp.exe 2284 ffxffrr.exe 2436 jjdvj.exe 2792 dvjjp.exe 1452 rlrxflr.exe 2720 5nnttt.exe 2904 9vvdj.exe 1940 xrllrlr.exe 2912 bnnnbn.exe 2372 dppdj.exe 2260 djdpj.exe 2220 9rrfffr.exe 2876 tnhttt.exe 1136 vvdpj.exe 2120 fllrrlr.exe 2356 tbnbbh.exe -
resource yara_rule behavioral1/memory/2336-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/788-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/340-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-940-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-955-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-962-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-975-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-995-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-1017-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-1030-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-1110-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2340-1112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-1156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-1237-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2916-1248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-1275-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2264-1311-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrlxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlllxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rxxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxfflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2508 2336 a965bcba7eb971d51a453d687e166d006cd539b77645b6f5a32e1f073d9c8c07.exe 30 PID 2336 wrote to memory of 2508 2336 a965bcba7eb971d51a453d687e166d006cd539b77645b6f5a32e1f073d9c8c07.exe 30 PID 2336 wrote to memory of 2508 2336 a965bcba7eb971d51a453d687e166d006cd539b77645b6f5a32e1f073d9c8c07.exe 30 PID 2336 wrote to memory of 2508 2336 a965bcba7eb971d51a453d687e166d006cd539b77645b6f5a32e1f073d9c8c07.exe 30 PID 2508 wrote to memory of 1992 2508 rrrxfll.exe 31 PID 2508 wrote to memory of 1992 2508 rrrxfll.exe 31 PID 2508 wrote to memory of 1992 2508 rrrxfll.exe 31 PID 2508 wrote to memory of 1992 2508 rrrxfll.exe 31 PID 1992 wrote to memory of 3056 1992 ntnnbh.exe 32 PID 1992 wrote to memory of 3056 1992 ntnnbh.exe 32 PID 1992 wrote to memory of 3056 1992 ntnnbh.exe 32 PID 1992 wrote to memory of 3056 1992 ntnnbh.exe 32 PID 3056 wrote to memory of 2980 3056 tnnnbb.exe 33 PID 3056 wrote to memory of 2980 3056 tnnnbb.exe 33 PID 3056 wrote to memory of 2980 3056 tnnnbb.exe 33 PID 3056 wrote to memory of 2980 3056 tnnnbb.exe 33 PID 2980 wrote to memory of 2732 2980 ppdpv.exe 34 PID 2980 wrote to memory of 2732 2980 ppdpv.exe 34 PID 2980 wrote to memory of 2732 2980 ppdpv.exe 34 PID 2980 wrote to memory of 2732 2980 ppdpv.exe 34 PID 2732 wrote to memory of 2636 2732 9nbhbn.exe 35 PID 2732 wrote to memory of 2636 2732 9nbhbn.exe 35 PID 2732 wrote to memory of 2636 2732 9nbhbn.exe 35 PID 2732 wrote to memory of 2636 2732 9nbhbn.exe 35 PID 2636 wrote to memory of 2664 2636 djdpj.exe 36 PID 2636 wrote to memory of 2664 2636 djdpj.exe 36 PID 2636 wrote to memory of 2664 2636 djdpj.exe 36 PID 2636 wrote to memory of 2664 2636 djdpj.exe 36 PID 2664 wrote to memory of 2872 2664 ppppd.exe 37 PID 2664 wrote to memory of 2872 2664 ppppd.exe 37 PID 2664 wrote to memory of 2872 2664 ppppd.exe 37 PID 2664 wrote to memory of 2872 2664 ppppd.exe 37 PID 2872 wrote to memory of 2696 2872 xrffrff.exe 38 PID 2872 wrote to memory of 2696 2872 xrffrff.exe 38 PID 2872 wrote to memory of 2696 2872 xrffrff.exe 38 PID 2872 wrote to memory of 2696 2872 xrffrff.exe 38 PID 2696 wrote to memory of 2564 2696 vpjvj.exe 39 PID 2696 wrote to memory of 2564 2696 vpjvj.exe 39 PID 2696 wrote to memory of 2564 2696 vpjvj.exe 39 PID 2696 wrote to memory of 2564 2696 vpjvj.exe 39 PID 2564 wrote to memory of 2584 2564 nnbtbt.exe 40 PID 2564 wrote to memory of 2584 2564 nnbtbt.exe 40 PID 2564 wrote to memory of 2584 2564 nnbtbt.exe 40 PID 2564 wrote to memory of 2584 2564 nnbtbt.exe 40 PID 2584 wrote to memory of 2916 2584 rllrrxl.exe 41 PID 2584 wrote to memory of 2916 2584 rllrrxl.exe 41 PID 2584 wrote to memory of 2916 2584 rllrrxl.exe 41 PID 2584 wrote to memory of 2916 2584 rllrrxl.exe 41 PID 2916 wrote to memory of 2504 2916 nnhtnt.exe 42 PID 2916 wrote to memory of 2504 2916 nnhtnt.exe 42 PID 2916 wrote to memory of 2504 2916 nnhtnt.exe 42 PID 2916 wrote to memory of 2504 2916 nnhtnt.exe 42 PID 2504 wrote to memory of 1452 2504 tbtbtt.exe 43 PID 2504 wrote to memory of 1452 2504 tbtbtt.exe 43 PID 2504 wrote to memory of 1452 2504 tbtbtt.exe 43 PID 2504 wrote to memory of 1452 2504 tbtbtt.exe 43 PID 1452 wrote to memory of 2720 1452 rxlfllr.exe 44 PID 1452 wrote to memory of 2720 1452 rxlfllr.exe 44 PID 1452 wrote to memory of 2720 1452 rxlfllr.exe 44 PID 1452 wrote to memory of 2720 1452 rxlfllr.exe 44 PID 2720 wrote to memory of 1728 2720 pvjvj.exe 45 PID 2720 wrote to memory of 1728 2720 pvjvj.exe 45 PID 2720 wrote to memory of 1728 2720 pvjvj.exe 45 PID 2720 wrote to memory of 1728 2720 pvjvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a965bcba7eb971d51a453d687e166d006cd539b77645b6f5a32e1f073d9c8c07.exe"C:\Users\Admin\AppData\Local\Temp\a965bcba7eb971d51a453d687e166d006cd539b77645b6f5a32e1f073d9c8c07.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\rrrxfll.exec:\rrrxfll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\ntnnbh.exec:\ntnnbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\tnnnbb.exec:\tnnnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\ppdpv.exec:\ppdpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\9nbhbn.exec:\9nbhbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\djdpj.exec:\djdpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\ppppd.exec:\ppppd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\xrffrff.exec:\xrffrff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\vpjvj.exec:\vpjvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\nnbtbt.exec:\nnbtbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\rllrrxl.exec:\rllrrxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\nnhtnt.exec:\nnhtnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\tbtbtt.exec:\tbtbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\rxlfllr.exec:\rxlfllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\pvjvj.exec:\pvjvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\7fxrllr.exec:\7fxrllr.exe17⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jjddd.exec:\jjddd.exe18⤵
- Executes dropped EXE
PID:1756 -
\??\c:\lxrfrfr.exec:\lxrfrfr.exe19⤵
- Executes dropped EXE
PID:2952 -
\??\c:\vpdpp.exec:\vpdpp.exe20⤵
- Executes dropped EXE
PID:2260 -
\??\c:\lrrffrr.exec:\lrrffrr.exe21⤵
- Executes dropped EXE
PID:2020 -
\??\c:\pjvdp.exec:\pjvdp.exe22⤵
- Executes dropped EXE
PID:1540 -
\??\c:\xxxffxl.exec:\xxxffxl.exe23⤵
- Executes dropped EXE
PID:2136 -
\??\c:\dddpd.exec:\dddpd.exe24⤵
- Executes dropped EXE
PID:2056 -
\??\c:\7ntbnb.exec:\7ntbnb.exe25⤵
- Executes dropped EXE
PID:1308 -
\??\c:\ddpjv.exec:\ddpjv.exe26⤵
- Executes dropped EXE
PID:2400 -
\??\c:\hhbnht.exec:\hhbnht.exe27⤵
- Executes dropped EXE
PID:852 -
\??\c:\ffxrlxl.exec:\ffxrlxl.exe28⤵
- Executes dropped EXE
PID:1488 -
\??\c:\vdvpd.exec:\vdvpd.exe29⤵
- Executes dropped EXE
PID:2172 -
\??\c:\9rflrrf.exec:\9rflrrf.exe30⤵
- Executes dropped EXE
PID:580 -
\??\c:\tnbnbb.exec:\tnbnbb.exe31⤵
- Executes dropped EXE
PID:788 -
\??\c:\xrxxllx.exec:\xrxxllx.exe32⤵
- Executes dropped EXE
PID:2128 -
\??\c:\pjpvv.exec:\pjpvv.exe33⤵
- Executes dropped EXE
PID:884 -
\??\c:\rrlrfxx.exec:\rrlrfxx.exe34⤵
- Executes dropped EXE
PID:592 -
\??\c:\ttbbhb.exec:\ttbbhb.exe35⤵
- Executes dropped EXE
PID:1552 -
\??\c:\jpjjp.exec:\jpjjp.exe36⤵
- Executes dropped EXE
PID:1944 -
\??\c:\9btbtb.exec:\9btbtb.exe37⤵
- Executes dropped EXE
PID:2460 -
\??\c:\ppvpv.exec:\ppvpv.exe38⤵
- Executes dropped EXE
PID:1260 -
\??\c:\xfrfxll.exec:\xfrfxll.exe39⤵
- Executes dropped EXE
PID:340 -
\??\c:\htnntt.exec:\htnntt.exe40⤵
- Executes dropped EXE
PID:2000 -
\??\c:\pdjjp.exec:\pdjjp.exe41⤵
- Executes dropped EXE
PID:2676 -
\??\c:\xrxllrr.exec:\xrxllrr.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2640 -
\??\c:\fffrflx.exec:\fffrflx.exe43⤵
- Executes dropped EXE
PID:3000 -
\??\c:\nbhbbb.exec:\nbhbbb.exe44⤵
- Executes dropped EXE
PID:2848 -
\??\c:\1rffxxl.exec:\1rffxxl.exe45⤵
- Executes dropped EXE
PID:2620 -
\??\c:\nbtnht.exec:\nbtnht.exe46⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jjvvd.exec:\jjvvd.exe47⤵
- Executes dropped EXE
PID:2544 -
\??\c:\rrrrrll.exec:\rrrrrll.exe48⤵
- Executes dropped EXE
PID:1864 -
\??\c:\nbnttt.exec:\nbnttt.exe49⤵
- Executes dropped EXE
PID:2564 -
\??\c:\vvjdp.exec:\vvjdp.exe50⤵
- Executes dropped EXE
PID:688 -
\??\c:\ffxffrr.exec:\ffxffrr.exe51⤵
- Executes dropped EXE
PID:2284 -
\??\c:\jjdvj.exec:\jjdvj.exe52⤵
- Executes dropped EXE
PID:2436 -
\??\c:\dvjjp.exec:\dvjjp.exe53⤵
- Executes dropped EXE
PID:2792 -
\??\c:\rlrxflr.exec:\rlrxflr.exe54⤵
- Executes dropped EXE
PID:1452 -
\??\c:\5nnttt.exec:\5nnttt.exe55⤵
- Executes dropped EXE
PID:2720 -
\??\c:\9vvdj.exec:\9vvdj.exe56⤵
- Executes dropped EXE
PID:2904 -
\??\c:\xrllrlr.exec:\xrllrlr.exe57⤵
- Executes dropped EXE
PID:1940 -
\??\c:\bnnnbn.exec:\bnnnbn.exe58⤵
- Executes dropped EXE
PID:2912 -
\??\c:\dppdj.exec:\dppdj.exe59⤵
- Executes dropped EXE
PID:2372 -
\??\c:\djdpj.exec:\djdpj.exe60⤵
- Executes dropped EXE
PID:2260 -
\??\c:\9rrfffr.exec:\9rrfffr.exe61⤵
- Executes dropped EXE
PID:2220 -
\??\c:\tnhttt.exec:\tnhttt.exe62⤵
- Executes dropped EXE
PID:2876 -
\??\c:\vvdpj.exec:\vvdpj.exe63⤵
- Executes dropped EXE
PID:1136 -
\??\c:\fllrrlr.exec:\fllrrlr.exe64⤵
- Executes dropped EXE
PID:2120 -
\??\c:\tbnbbh.exec:\tbnbbh.exe65⤵
- Executes dropped EXE
PID:2356 -
\??\c:\nbhntn.exec:\nbhntn.exe66⤵PID:1664
-
\??\c:\pdjpd.exec:\pdjpd.exe67⤵PID:1564
-
\??\c:\rxrlxfr.exec:\rxrlxfr.exe68⤵PID:2400
-
\??\c:\btnnnt.exec:\btnnnt.exe69⤵PID:1732
-
\??\c:\pjvdj.exec:\pjvdj.exe70⤵PID:1676
-
\??\c:\lfrrrlr.exec:\lfrrrlr.exe71⤵PID:2072
-
\??\c:\hhnthb.exec:\hhnthb.exe72⤵PID:1052
-
\??\c:\dpdvj.exec:\dpdvj.exe73⤵PID:1572
-
\??\c:\lrxllll.exec:\lrxllll.exe74⤵
- System Location Discovery: System Language Discovery
PID:800 -
\??\c:\hnhtth.exec:\hnhtth.exe75⤵PID:484
-
\??\c:\lrxfrxf.exec:\lrxfrxf.exe76⤵PID:1888
-
\??\c:\bthhbb.exec:\bthhbb.exe77⤵PID:2348
-
\??\c:\7bbntn.exec:\7bbntn.exe78⤵PID:1548
-
\??\c:\jdpjj.exec:\jdpjj.exe79⤵PID:772
-
\??\c:\9flxlxx.exec:\9flxlxx.exe80⤵PID:2472
-
\??\c:\btbttn.exec:\btbttn.exe81⤵
- System Location Discovery: System Language Discovery
PID:2460 -
\??\c:\jddjj.exec:\jddjj.exe82⤵PID:3032
-
\??\c:\ffffrxf.exec:\ffffrxf.exe83⤵PID:2276
-
\??\c:\bthhnn.exec:\bthhnn.exe84⤵PID:2808
-
\??\c:\dvppp.exec:\dvppp.exe85⤵PID:756
-
\??\c:\rrlxxfl.exec:\rrlxxfl.exe86⤵PID:2732
-
\??\c:\tnbhnt.exec:\tnbhnt.exe87⤵PID:768
-
\??\c:\9pdvd.exec:\9pdvd.exe88⤵PID:2540
-
\??\c:\xrflflx.exec:\xrflflx.exe89⤵PID:2568
-
\??\c:\pppvv.exec:\pppvv.exe90⤵PID:2804
-
\??\c:\bthnbh.exec:\bthnbh.exe91⤵PID:2872
-
\??\c:\hnhhnt.exec:\hnhhnt.exe92⤵PID:2196
-
\??\c:\dvjdd.exec:\dvjdd.exe93⤵PID:2224
-
\??\c:\9fxffll.exec:\9fxffll.exe94⤵PID:2180
-
\??\c:\htbnnb.exec:\htbnnb.exe95⤵PID:1792
-
\??\c:\ppjjv.exec:\ppjjv.exe96⤵PID:2916
-
\??\c:\rlfrrxr.exec:\rlfrrxr.exe97⤵PID:2504
-
\??\c:\xllxlrf.exec:\xllxlrf.exe98⤵PID:2836
-
\??\c:\dvjpv.exec:\dvjpv.exe99⤵PID:2900
-
\??\c:\dpjjp.exec:\dpjjp.exe100⤵PID:1840
-
\??\c:\lrfrlrl.exec:\lrfrlrl.exe101⤵PID:2972
-
\??\c:\tbhbth.exec:\tbhbth.exe102⤵PID:2928
-
\??\c:\vvvpd.exec:\vvvpd.exe103⤵PID:2964
-
\??\c:\djjvp.exec:\djjvp.exe104⤵PID:3048
-
\??\c:\9rrfrxr.exec:\9rrfrxr.exe105⤵PID:2252
-
\??\c:\hnnhth.exec:\hnnhth.exe106⤵PID:1420
-
\??\c:\pjjvd.exec:\pjjvd.exe107⤵PID:2220
-
\??\c:\rlxxllx.exec:\rlxxllx.exe108⤵PID:3020
-
\??\c:\rxlllfr.exec:\rxlllfr.exe109⤵PID:1044
-
\??\c:\htbthh.exec:\htbthh.exe110⤵PID:1804
-
\??\c:\ppdpv.exec:\ppdpv.exe111⤵PID:1592
-
\??\c:\rflrrll.exec:\rflrrll.exe112⤵PID:1580
-
\??\c:\bbthhb.exec:\bbthhb.exe113⤵PID:1032
-
\??\c:\vddpd.exec:\vddpd.exe114⤵PID:1600
-
\??\c:\ppjdp.exec:\ppjdp.exe115⤵PID:108
-
\??\c:\rrfllrf.exec:\rrfllrf.exe116⤵PID:1676
-
\??\c:\btnbtb.exec:\btnbtb.exe117⤵PID:2340
-
\??\c:\jvdpj.exec:\jvdpj.exe118⤵PID:1052
-
\??\c:\rllfxxx.exec:\rllfxxx.exe119⤵PID:1572
-
\??\c:\9xrrxlf.exec:\9xrrxlf.exe120⤵PID:800
-
\??\c:\1ttbnt.exec:\1ttbnt.exe121⤵PID:484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-