Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 20:22
Behavioral task
behavioral1
Sample
1e866cfd55fe4a4278bf87eb03adf6cc2b5a4ffa21a18af6c1c67776c2b3a6f1.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
1e866cfd55fe4a4278bf87eb03adf6cc2b5a4ffa21a18af6c1c67776c2b3a6f1.exe
-
Size
332KB
-
MD5
ebe4f2dd0b0eff38500e24b0a88532a4
-
SHA1
2f66b39cfa051a7717423a11861b745a3e8e73a3
-
SHA256
1e866cfd55fe4a4278bf87eb03adf6cc2b5a4ffa21a18af6c1c67776c2b3a6f1
-
SHA512
fab7ecfc4518d6722379cb66c26f52cb495720affb55f15a1ddb0bb672c30e8df4a18dbc52ccc03e70a7d877f3cda6ed6a01e70467996bbbc586e15961de6087
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbel:R4wFHoSHYHUrAwfMp3CDl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/3028-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2096-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1192-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-48-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2608-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/392-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2996-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2996-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2420-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/480-163-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/480-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-175-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1736-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/376-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1356-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2528-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/616-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2068-390-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2372-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1140-419-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1800-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-589-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-611-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-617-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-633-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2748-676-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-6884-0x0000000077620000-0x000000007771A000-memory.dmp family_blackmoon behavioral1/memory/2512-6883-0x0000000077720000-0x000000007783F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2096 nnttht.exe 1192 xlllrlr.exe 2756 dpdjd.exe 2760 tttbtn.exe 2896 dvjjv.exe 2792 hthtbh.exe 2608 pvjdd.exe 2572 bbbbth.exe 392 bbbtnh.exe 2728 7xffrlf.exe 2036 bhbtht.exe 2996 rfllrxl.exe 2168 htbhth.exe 1660 vpppv.exe 1596 5bbbth.exe 2784 rfrllff.exe 1440 thtntt.exe 1800 5xlfflr.exe 480 lrlxrlf.exe 2420 jpjdv.exe 1736 rrflfrx.exe 1636 dvjdp.exe 376 9rrrlrl.exe 1704 djjdd.exe 2268 pvvjj.exe 1352 btnntt.exe 1876 vvpvj.exe 1356 xfxfxlf.exe 2528 3nttnb.exe 744 1xfrrxl.exe 1720 bnbbnb.exe 2160 1rlrrff.exe 2028 nthbbn.exe 616 ppvvv.exe 1516 3fffffx.exe 3020 xffxflx.exe 3032 1hnhhb.exe 1608 jjdpj.exe 1616 fxrrffx.exe 2664 5ttnbh.exe 2776 bnthnb.exe 2764 5jpdd.exe 2760 3lfllrf.exe 2832 hbthhn.exe 2448 hnhbbn.exe 1732 vppjp.exe 2696 rxxxrff.exe 2624 tnbbbh.exe 2972 nbnnhn.exe 2732 jdvdj.exe 2728 rrrlfxl.exe 1868 nttnbt.exe 3012 vvdvp.exe 2656 jjjjj.exe 2068 lrfxlll.exe 2060 htnttt.exe 2372 vdjdd.exe 2852 llllrxl.exe 2860 bhthbt.exe 1140 bbntnb.exe 1480 dpjpd.exe 1800 lfxrrrr.exe 1492 xxrfflf.exe 2916 hnbtnt.exe -
resource yara_rule behavioral1/memory/3028-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a00000001225d-6.dat upx behavioral1/memory/2096-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015686-15.dat upx behavioral1/memory/2096-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015694-23.dat upx behavioral1/memory/1192-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-30-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00070000000156b5-31.dat upx behavioral1/memory/2760-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015c0d-41.dat upx behavioral1/memory/2760-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2896-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015ccc-49.dat upx behavioral1/files/0x0009000000015ce1-57.dat upx behavioral1/files/0x0008000000015cfa-64.dat upx behavioral1/memory/2572-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2608-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015e64-73.dat upx behavioral1/files/0x0006000000015ed2-80.dat upx behavioral1/memory/392-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015f96-89.dat upx behavioral1/memory/2728-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2036-96-0x0000000000430000-0x0000000000457000-memory.dmp upx behavioral1/memory/2996-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016009-98.dat upx behavioral1/files/0x000600000001613e-107.dat upx behavioral1/memory/2996-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016210-113.dat upx behavioral1/memory/1660-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2168-114-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0006000000016334-122.dat upx behavioral1/memory/1596-129-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x00290000000150a7-130.dat upx behavioral1/files/0x00060000000164db-138.dat upx behavioral1/memory/2784-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001659b-144.dat upx behavioral1/files/0x0006000000016645-152.dat upx behavioral1/memory/480-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001686c-160.dat upx behavioral1/memory/2420-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/480-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1736-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016ac1-170.dat upx behavioral1/memory/1736-175-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0006000000016c73-180.dat upx behavioral1/memory/1736-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c8c-187.dat upx behavioral1/memory/376-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c95-195.dat upx behavioral1/files/0x0006000000016ce1-202.dat upx behavioral1/files/0x0006000000016d0d-209.dat upx behavioral1/files/0x0006000000016d36-216.dat upx behavioral1/files/0x0006000000016d47-223.dat upx behavioral1/files/0x0006000000016d4f-231.dat upx behavioral1/memory/1356-230-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2528-238-0x00000000002C0000-0x00000000002E7000-memory.dmp upx behavioral1/files/0x0006000000016d58-241.dat upx behavioral1/memory/2528-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016da7-247.dat upx behavioral1/files/0x0006000000016db5-254.dat upx behavioral1/memory/616-272-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3020-280-0x0000000000220000-0x0000000000247000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2096 3028 1e866cfd55fe4a4278bf87eb03adf6cc2b5a4ffa21a18af6c1c67776c2b3a6f1.exe 30 PID 3028 wrote to memory of 2096 3028 1e866cfd55fe4a4278bf87eb03adf6cc2b5a4ffa21a18af6c1c67776c2b3a6f1.exe 30 PID 3028 wrote to memory of 2096 3028 1e866cfd55fe4a4278bf87eb03adf6cc2b5a4ffa21a18af6c1c67776c2b3a6f1.exe 30 PID 3028 wrote to memory of 2096 3028 1e866cfd55fe4a4278bf87eb03adf6cc2b5a4ffa21a18af6c1c67776c2b3a6f1.exe 30 PID 2096 wrote to memory of 1192 2096 nnttht.exe 31 PID 2096 wrote to memory of 1192 2096 nnttht.exe 31 PID 2096 wrote to memory of 1192 2096 nnttht.exe 31 PID 2096 wrote to memory of 1192 2096 nnttht.exe 31 PID 1192 wrote to memory of 2756 1192 xlllrlr.exe 32 PID 1192 wrote to memory of 2756 1192 xlllrlr.exe 32 PID 1192 wrote to memory of 2756 1192 xlllrlr.exe 32 PID 1192 wrote to memory of 2756 1192 xlllrlr.exe 32 PID 2756 wrote to memory of 2760 2756 dpdjd.exe 33 PID 2756 wrote to memory of 2760 2756 dpdjd.exe 33 PID 2756 wrote to memory of 2760 2756 dpdjd.exe 33 PID 2756 wrote to memory of 2760 2756 dpdjd.exe 33 PID 2760 wrote to memory of 2896 2760 tttbtn.exe 34 PID 2760 wrote to memory of 2896 2760 tttbtn.exe 34 PID 2760 wrote to memory of 2896 2760 tttbtn.exe 34 PID 2760 wrote to memory of 2896 2760 tttbtn.exe 34 PID 2896 wrote to memory of 2792 2896 dvjjv.exe 35 PID 2896 wrote to memory of 2792 2896 dvjjv.exe 35 PID 2896 wrote to memory of 2792 2896 dvjjv.exe 35 PID 2896 wrote to memory of 2792 2896 dvjjv.exe 35 PID 2792 wrote to memory of 2608 2792 hthtbh.exe 36 PID 2792 wrote to memory of 2608 2792 hthtbh.exe 36 PID 2792 wrote to memory of 2608 2792 hthtbh.exe 36 PID 2792 wrote to memory of 2608 2792 hthtbh.exe 36 PID 2608 wrote to memory of 2572 2608 pvjdd.exe 37 PID 2608 wrote to memory of 2572 2608 pvjdd.exe 37 PID 2608 wrote to memory of 2572 2608 pvjdd.exe 37 PID 2608 wrote to memory of 2572 2608 pvjdd.exe 37 PID 2572 wrote to memory of 392 2572 bbbbth.exe 38 PID 2572 wrote to memory of 392 2572 bbbbth.exe 38 PID 2572 wrote to memory of 392 2572 bbbbth.exe 38 PID 2572 wrote to memory of 392 2572 bbbbth.exe 38 PID 392 wrote to memory of 2728 392 bbbtnh.exe 39 PID 392 wrote to memory of 2728 392 bbbtnh.exe 39 PID 392 wrote to memory of 2728 392 bbbtnh.exe 39 PID 392 wrote to memory of 2728 392 bbbtnh.exe 39 PID 2728 wrote to memory of 2036 2728 7xffrlf.exe 40 PID 2728 wrote to memory of 2036 2728 7xffrlf.exe 40 PID 2728 wrote to memory of 2036 2728 7xffrlf.exe 40 PID 2728 wrote to memory of 2036 2728 7xffrlf.exe 40 PID 2036 wrote to memory of 2996 2036 bhbtht.exe 41 PID 2036 wrote to memory of 2996 2036 bhbtht.exe 41 PID 2036 wrote to memory of 2996 2036 bhbtht.exe 41 PID 2036 wrote to memory of 2996 2036 bhbtht.exe 41 PID 2996 wrote to memory of 2168 2996 rfllrxl.exe 42 PID 2996 wrote to memory of 2168 2996 rfllrxl.exe 42 PID 2996 wrote to memory of 2168 2996 rfllrxl.exe 42 PID 2996 wrote to memory of 2168 2996 rfllrxl.exe 42 PID 2168 wrote to memory of 1660 2168 htbhth.exe 43 PID 2168 wrote to memory of 1660 2168 htbhth.exe 43 PID 2168 wrote to memory of 1660 2168 htbhth.exe 43 PID 2168 wrote to memory of 1660 2168 htbhth.exe 43 PID 1660 wrote to memory of 1596 1660 vpppv.exe 44 PID 1660 wrote to memory of 1596 1660 vpppv.exe 44 PID 1660 wrote to memory of 1596 1660 vpppv.exe 44 PID 1660 wrote to memory of 1596 1660 vpppv.exe 44 PID 1596 wrote to memory of 2784 1596 5bbbth.exe 45 PID 1596 wrote to memory of 2784 1596 5bbbth.exe 45 PID 1596 wrote to memory of 2784 1596 5bbbth.exe 45 PID 1596 wrote to memory of 2784 1596 5bbbth.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e866cfd55fe4a4278bf87eb03adf6cc2b5a4ffa21a18af6c1c67776c2b3a6f1.exe"C:\Users\Admin\AppData\Local\Temp\1e866cfd55fe4a4278bf87eb03adf6cc2b5a4ffa21a18af6c1c67776c2b3a6f1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\nnttht.exec:\nnttht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\xlllrlr.exec:\xlllrlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\dpdjd.exec:\dpdjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\tttbtn.exec:\tttbtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\dvjjv.exec:\dvjjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\hthtbh.exec:\hthtbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\pvjdd.exec:\pvjdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\bbbbth.exec:\bbbbth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\bbbtnh.exec:\bbbtnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\7xffrlf.exec:\7xffrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\bhbtht.exec:\bhbtht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\rfllrxl.exec:\rfllrxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\htbhth.exec:\htbhth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\vpppv.exec:\vpppv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\5bbbth.exec:\5bbbth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\rfrllff.exec:\rfrllff.exe17⤵
- Executes dropped EXE
PID:2784 -
\??\c:\thtntt.exec:\thtntt.exe18⤵
- Executes dropped EXE
PID:1440 -
\??\c:\5xlfflr.exec:\5xlfflr.exe19⤵
- Executes dropped EXE
PID:1800 -
\??\c:\lrlxrlf.exec:\lrlxrlf.exe20⤵
- Executes dropped EXE
PID:480 -
\??\c:\jpjdv.exec:\jpjdv.exe21⤵
- Executes dropped EXE
PID:2420 -
\??\c:\rrflfrx.exec:\rrflfrx.exe22⤵
- Executes dropped EXE
PID:1736 -
\??\c:\dvjdp.exec:\dvjdp.exe23⤵
- Executes dropped EXE
PID:1636 -
\??\c:\9rrrlrl.exec:\9rrrlrl.exe24⤵
- Executes dropped EXE
PID:376 -
\??\c:\djjdd.exec:\djjdd.exe25⤵
- Executes dropped EXE
PID:1704 -
\??\c:\pvvjj.exec:\pvvjj.exe26⤵
- Executes dropped EXE
PID:2268 -
\??\c:\btnntt.exec:\btnntt.exe27⤵
- Executes dropped EXE
PID:1352 -
\??\c:\vvpvj.exec:\vvpvj.exe28⤵
- Executes dropped EXE
PID:1876 -
\??\c:\xfxfxlf.exec:\xfxfxlf.exe29⤵
- Executes dropped EXE
PID:1356 -
\??\c:\3nttnb.exec:\3nttnb.exe30⤵
- Executes dropped EXE
PID:2528 -
\??\c:\1xfrrxl.exec:\1xfrrxl.exe31⤵
- Executes dropped EXE
PID:744 -
\??\c:\bnbbnb.exec:\bnbbnb.exe32⤵
- Executes dropped EXE
PID:1720 -
\??\c:\1rlrrff.exec:\1rlrrff.exe33⤵
- Executes dropped EXE
PID:2160 -
\??\c:\nthbbn.exec:\nthbbn.exe34⤵
- Executes dropped EXE
PID:2028 -
\??\c:\ppvvv.exec:\ppvvv.exe35⤵
- Executes dropped EXE
PID:616 -
\??\c:\3fffffx.exec:\3fffffx.exe36⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xffxflx.exec:\xffxflx.exe37⤵
- Executes dropped EXE
PID:3020 -
\??\c:\1hnhhb.exec:\1hnhhb.exe38⤵
- Executes dropped EXE
PID:3032 -
\??\c:\jjdpj.exec:\jjdpj.exe39⤵
- Executes dropped EXE
PID:1608 -
\??\c:\fxrrffx.exec:\fxrrffx.exe40⤵
- Executes dropped EXE
PID:1616 -
\??\c:\5ttnbh.exec:\5ttnbh.exe41⤵
- Executes dropped EXE
PID:2664 -
\??\c:\bnthnb.exec:\bnthnb.exe42⤵
- Executes dropped EXE
PID:2776 -
\??\c:\5jpdd.exec:\5jpdd.exe43⤵
- Executes dropped EXE
PID:2764 -
\??\c:\3lfllrf.exec:\3lfllrf.exe44⤵
- Executes dropped EXE
PID:2760 -
\??\c:\hbthhn.exec:\hbthhn.exe45⤵
- Executes dropped EXE
PID:2832 -
\??\c:\hnhbbn.exec:\hnhbbn.exe46⤵
- Executes dropped EXE
PID:2448 -
\??\c:\vppjp.exec:\vppjp.exe47⤵
- Executes dropped EXE
PID:1732 -
\??\c:\rxxxrff.exec:\rxxxrff.exe48⤵
- Executes dropped EXE
PID:2696 -
\??\c:\tnbbbh.exec:\tnbbbh.exe49⤵
- Executes dropped EXE
PID:2624 -
\??\c:\nbnnhn.exec:\nbnnhn.exe50⤵
- Executes dropped EXE
PID:2972 -
\??\c:\jdvdj.exec:\jdvdj.exe51⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rrrlfxl.exec:\rrrlfxl.exe52⤵
- Executes dropped EXE
PID:2728 -
\??\c:\nttnbt.exec:\nttnbt.exe53⤵
- Executes dropped EXE
PID:1868 -
\??\c:\vvdvp.exec:\vvdvp.exe54⤵
- Executes dropped EXE
PID:3012 -
\??\c:\jjjjj.exec:\jjjjj.exe55⤵
- Executes dropped EXE
PID:2656 -
\??\c:\lrfxlll.exec:\lrfxlll.exe56⤵
- Executes dropped EXE
PID:2068 -
\??\c:\htnttt.exec:\htnttt.exe57⤵
- Executes dropped EXE
PID:2060 -
\??\c:\vdjdd.exec:\vdjdd.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2372 -
\??\c:\llllrxl.exec:\llllrxl.exe59⤵
- Executes dropped EXE
PID:2852 -
\??\c:\bhthbt.exec:\bhthbt.exe60⤵
- Executes dropped EXE
PID:2860 -
\??\c:\bbntnb.exec:\bbntnb.exe61⤵
- Executes dropped EXE
PID:1140 -
\??\c:\dpjpd.exec:\dpjpd.exe62⤵
- Executes dropped EXE
PID:1480 -
\??\c:\lfxrrrr.exec:\lfxrrrr.exe63⤵
- Executes dropped EXE
PID:1800 -
\??\c:\xxrfflf.exec:\xxrfflf.exe64⤵
- Executes dropped EXE
PID:1492 -
\??\c:\hnbtnt.exec:\hnbtnt.exe65⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ppddp.exec:\ppddp.exe66⤵PID:2140
-
\??\c:\fflffrf.exec:\fflffrf.exe67⤵PID:2912
-
\??\c:\fflfxlr.exec:\fflfxlr.exe68⤵PID:288
-
\??\c:\1tbtnb.exec:\1tbtnb.exe69⤵PID:1324
-
\??\c:\djjjd.exec:\djjjd.exe70⤵PID:2260
-
\??\c:\xrrlfxf.exec:\xrrlfxf.exe71⤵PID:2224
-
\??\c:\flfxrrf.exec:\flfxrrf.exe72⤵PID:700
-
\??\c:\nnntnh.exec:\nnntnh.exe73⤵PID:1532
-
\??\c:\5ddjd.exec:\5ddjd.exe74⤵PID:1552
-
\??\c:\jdvdj.exec:\jdvdj.exe75⤵PID:1044
-
\??\c:\flrfrfx.exec:\flrfrfx.exe76⤵PID:1444
-
\??\c:\frfxfxl.exec:\frfxfxl.exe77⤵PID:1300
-
\??\c:\3hbnnb.exec:\3hbnnb.exe78⤵PID:1172
-
\??\c:\pvvpv.exec:\pvvpv.exe79⤵PID:324
-
\??\c:\vjpvp.exec:\vjpvp.exe80⤵PID:2352
-
\??\c:\llllfrl.exec:\llllfrl.exe81⤵PID:1488
-
\??\c:\thbnhb.exec:\thbnhb.exe82⤵PID:2044
-
\??\c:\3dvjv.exec:\3dvjv.exe83⤵PID:1512
-
\??\c:\vdvdj.exec:\vdvdj.exe84⤵PID:2120
-
\??\c:\lxxrxll.exec:\lxxrxll.exe85⤵PID:2476
-
\??\c:\hhhhnb.exec:\hhhhnb.exe86⤵PID:2876
-
\??\c:\jjdjd.exec:\jjdjd.exe87⤵PID:1612
-
\??\c:\dvpvp.exec:\dvpvp.exe88⤵PID:3056
-
\??\c:\rrllfrl.exec:\rrllfrl.exe89⤵PID:1192
-
\??\c:\hbbnnb.exec:\hbbnnb.exe90⤵PID:2904
-
\??\c:\pjjpd.exec:\pjjpd.exe91⤵PID:2700
-
\??\c:\dvddp.exec:\dvddp.exe92⤵PID:2568
-
\??\c:\rxlflrx.exec:\rxlflrx.exe93⤵PID:2828
-
\??\c:\hbhbhn.exec:\hbhbhn.exe94⤵PID:2792
-
\??\c:\hhbnhn.exec:\hhbnhn.exe95⤵PID:2560
-
\??\c:\pvpvj.exec:\pvpvj.exe96⤵PID:2564
-
\??\c:\frllrfr.exec:\frllrfr.exe97⤵PID:1748
-
\??\c:\tbbtnt.exec:\tbbtnt.exe98⤵PID:2348
-
\??\c:\vvvdd.exec:\vvvdd.exe99⤵PID:392
-
\??\c:\pjdpv.exec:\pjdpv.exe100⤵PID:1792
-
\??\c:\lrrlflf.exec:\lrrlflf.exe101⤵PID:2968
-
\??\c:\bbhbbh.exec:\bbhbbh.exe102⤵PID:2176
-
\??\c:\hnbtnb.exec:\hnbtnb.exe103⤵PID:2188
-
\??\c:\jvjvp.exec:\jvjvp.exe104⤵PID:464
-
\??\c:\fllxlxx.exec:\fllxlxx.exe105⤵PID:2172
-
\??\c:\xrrlxlx.exec:\xrrlxlx.exe106⤵PID:2060
-
\??\c:\bbtbnb.exec:\bbtbnb.exe107⤵PID:664
-
\??\c:\pvvvv.exec:\pvvvv.exe108⤵PID:2748
-
\??\c:\7pdvv.exec:\7pdvv.exe109⤵PID:2784
-
\??\c:\fflfxrl.exec:\fflfxrl.exe110⤵PID:1140
-
\??\c:\llllrlf.exec:\llllrlf.exe111⤵PID:1136
-
\??\c:\hhhbnh.exec:\hhhbnh.exe112⤵PID:328
-
\??\c:\ppvdd.exec:\ppvdd.exe113⤵PID:2920
-
\??\c:\dvjpj.exec:\dvjpj.exe114⤵PID:2924
-
\??\c:\rxxfrfx.exec:\rxxfrfx.exe115⤵PID:2524
-
\??\c:\tbtnnn.exec:\tbtnnn.exe116⤵PID:1672
-
\??\c:\ttnhnh.exec:\ttnhnh.exe117⤵PID:1572
-
\??\c:\vpjpd.exec:\vpjpd.exe118⤵PID:1548
-
\??\c:\llflxlf.exec:\llflxlf.exe119⤵PID:640
-
\??\c:\7bbbnb.exec:\7bbbnb.exe120⤵PID:2548
-
\??\c:\tbhtht.exec:\tbhtht.exe121⤵PID:2744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-