Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 00:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
745fc305fb8a9429dcf042c5a9d409897df76187d3ac112446d1f6bee53ba87e.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
745fc305fb8a9429dcf042c5a9d409897df76187d3ac112446d1f6bee53ba87e.exe
-
Size
456KB
-
MD5
077d40d43e799d020472eb47983000c4
-
SHA1
877ff8c579668c854c403118e31a2f26c09f1d2f
-
SHA256
745fc305fb8a9429dcf042c5a9d409897df76187d3ac112446d1f6bee53ba87e
-
SHA512
0f5f8fac7ed4dcca1591464898f2a864f79f1a1aad6445dc1ec69ec1cbc899b9776bb9531d00713fa00183012ef42cd34f90d6d528cb9a8bbc57f2b2b021b28b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRwK:q7Tc2NYHUrAwfMp3CDRwK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/1996-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1476-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-84-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2848-99-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1452-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-122-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2096-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/284-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-160-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1200-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-315-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2656-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-485-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/348-492-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2472-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-597-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2932-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-632-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-665-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1036-690-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1648-699-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2232-722-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-735-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2316 9nhhtt.exe 1476 dddjd.exe 2156 lxrrxxf.exe 2636 3pjvp.exe 2856 3fxflrr.exe 2104 jvvjv.exe 2124 xxrrrfr.exe 2580 1tntht.exe 2552 1rlxlrl.exe 2848 jppdd.exe 1452 lxxllfx.exe 2036 9vpdp.exe 1864 ntnthn.exe 2096 9jdjp.exe 1980 9bthnh.exe 1612 dvpjv.exe 284 ntnhhh.exe 2764 5bnttt.exe 2628 btntnn.exe 952 vpjpd.exe 1900 btntbh.exe 1984 fxfxfxl.exe 1200 1pjjp.exe 2136 jjddp.exe 2208 vjdpj.exe 2260 jdpdj.exe 2276 vdjdd.exe 2928 fxlxrxf.exe 2076 thtbhn.exe 2324 5pjvj.exe 1584 5thhnn.exe 2924 9dpvd.exe 2868 7hhbnn.exe 2400 ppjpv.exe 2660 3xrxlxl.exe 2656 btntbh.exe 2940 dvjvj.exe 2828 vdpjv.exe 2692 1xllxfl.exe 2124 nnbhnn.exe 2528 7pjjj.exe 2652 7vppp.exe 1936 rrlxlrx.exe 1728 hbnnbh.exe 1904 vpddj.exe 2632 9xrxlxf.exe 1732 llfrxfx.exe 1948 hhthtb.exe 1724 jdvdj.exe 2600 5rflrxl.exe 872 ttntnt.exe 2044 ddvdj.exe 2892 dvpvv.exe 2772 1fllrrf.exe 1928 tnhnbh.exe 2628 9pjpv.exe 1484 5fxlrxr.exe 1328 nhhnbh.exe 348 pjjvp.exe 848 1xxrrrx.exe 1432 1bbnbh.exe 1320 3bnnnh.exe 2148 vvjvd.exe 2384 lfxlffl.exe -
resource yara_rule behavioral1/memory/1996-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-99-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1452-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-162-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/952-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-218-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1200-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-597-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2932-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-639-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1972-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-690-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2232-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-735-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-787-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-801-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rxffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1996 wrote to memory of 2316 1996 745fc305fb8a9429dcf042c5a9d409897df76187d3ac112446d1f6bee53ba87e.exe 31 PID 1996 wrote to memory of 2316 1996 745fc305fb8a9429dcf042c5a9d409897df76187d3ac112446d1f6bee53ba87e.exe 31 PID 1996 wrote to memory of 2316 1996 745fc305fb8a9429dcf042c5a9d409897df76187d3ac112446d1f6bee53ba87e.exe 31 PID 1996 wrote to memory of 2316 1996 745fc305fb8a9429dcf042c5a9d409897df76187d3ac112446d1f6bee53ba87e.exe 31 PID 2316 wrote to memory of 1476 2316 9nhhtt.exe 32 PID 2316 wrote to memory of 1476 2316 9nhhtt.exe 32 PID 2316 wrote to memory of 1476 2316 9nhhtt.exe 32 PID 2316 wrote to memory of 1476 2316 9nhhtt.exe 32 PID 1476 wrote to memory of 2156 1476 dddjd.exe 33 PID 1476 wrote to memory of 2156 1476 dddjd.exe 33 PID 1476 wrote to memory of 2156 1476 dddjd.exe 33 PID 1476 wrote to memory of 2156 1476 dddjd.exe 33 PID 2156 wrote to memory of 2636 2156 lxrrxxf.exe 34 PID 2156 wrote to memory of 2636 2156 lxrrxxf.exe 34 PID 2156 wrote to memory of 2636 2156 lxrrxxf.exe 34 PID 2156 wrote to memory of 2636 2156 lxrrxxf.exe 34 PID 2636 wrote to memory of 2856 2636 3pjvp.exe 35 PID 2636 wrote to memory of 2856 2636 3pjvp.exe 35 PID 2636 wrote to memory of 2856 2636 3pjvp.exe 35 PID 2636 wrote to memory of 2856 2636 3pjvp.exe 35 PID 2856 wrote to memory of 2104 2856 3fxflrr.exe 36 PID 2856 wrote to memory of 2104 2856 3fxflrr.exe 36 PID 2856 wrote to memory of 2104 2856 3fxflrr.exe 36 PID 2856 wrote to memory of 2104 2856 3fxflrr.exe 36 PID 2104 wrote to memory of 2124 2104 jvvjv.exe 37 PID 2104 wrote to memory of 2124 2104 jvvjv.exe 37 PID 2104 wrote to memory of 2124 2104 jvvjv.exe 37 PID 2104 wrote to memory of 2124 2104 jvvjv.exe 37 PID 2124 wrote to memory of 2580 2124 xxrrrfr.exe 38 PID 2124 wrote to memory of 2580 2124 xxrrrfr.exe 38 PID 2124 wrote to memory of 2580 2124 xxrrrfr.exe 38 PID 2124 wrote to memory of 2580 2124 xxrrrfr.exe 38 PID 2580 wrote to memory of 2552 2580 1tntht.exe 39 PID 2580 wrote to memory of 2552 2580 1tntht.exe 39 PID 2580 wrote to memory of 2552 2580 1tntht.exe 39 PID 2580 wrote to memory of 2552 2580 1tntht.exe 39 PID 2552 wrote to memory of 2848 2552 1rlxlrl.exe 40 PID 2552 wrote to memory of 2848 2552 1rlxlrl.exe 40 PID 2552 wrote to memory of 2848 2552 1rlxlrl.exe 40 PID 2552 wrote to memory of 2848 2552 1rlxlrl.exe 40 PID 2848 wrote to memory of 1452 2848 jppdd.exe 41 PID 2848 wrote to memory of 1452 2848 jppdd.exe 41 PID 2848 wrote to memory of 1452 2848 jppdd.exe 41 PID 2848 wrote to memory of 1452 2848 jppdd.exe 41 PID 1452 wrote to memory of 2036 1452 lxxllfx.exe 42 PID 1452 wrote to memory of 2036 1452 lxxllfx.exe 42 PID 1452 wrote to memory of 2036 1452 lxxllfx.exe 42 PID 1452 wrote to memory of 2036 1452 lxxllfx.exe 42 PID 2036 wrote to memory of 1864 2036 9vpdp.exe 43 PID 2036 wrote to memory of 1864 2036 9vpdp.exe 43 PID 2036 wrote to memory of 1864 2036 9vpdp.exe 43 PID 2036 wrote to memory of 1864 2036 9vpdp.exe 43 PID 1864 wrote to memory of 2096 1864 ntnthn.exe 44 PID 1864 wrote to memory of 2096 1864 ntnthn.exe 44 PID 1864 wrote to memory of 2096 1864 ntnthn.exe 44 PID 1864 wrote to memory of 2096 1864 ntnthn.exe 44 PID 2096 wrote to memory of 1980 2096 9jdjp.exe 45 PID 2096 wrote to memory of 1980 2096 9jdjp.exe 45 PID 2096 wrote to memory of 1980 2096 9jdjp.exe 45 PID 2096 wrote to memory of 1980 2096 9jdjp.exe 45 PID 1980 wrote to memory of 1612 1980 9bthnh.exe 46 PID 1980 wrote to memory of 1612 1980 9bthnh.exe 46 PID 1980 wrote to memory of 1612 1980 9bthnh.exe 46 PID 1980 wrote to memory of 1612 1980 9bthnh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\745fc305fb8a9429dcf042c5a9d409897df76187d3ac112446d1f6bee53ba87e.exe"C:\Users\Admin\AppData\Local\Temp\745fc305fb8a9429dcf042c5a9d409897df76187d3ac112446d1f6bee53ba87e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\9nhhtt.exec:\9nhhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\dddjd.exec:\dddjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\lxrrxxf.exec:\lxrrxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\3pjvp.exec:\3pjvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\3fxflrr.exec:\3fxflrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\jvvjv.exec:\jvvjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\xxrrrfr.exec:\xxrrrfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\1tntht.exec:\1tntht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\1rlxlrl.exec:\1rlxlrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\jppdd.exec:\jppdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\lxxllfx.exec:\lxxllfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\9vpdp.exec:\9vpdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\ntnthn.exec:\ntnthn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\9jdjp.exec:\9jdjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\9bthnh.exec:\9bthnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\dvpjv.exec:\dvpjv.exe17⤵
- Executes dropped EXE
PID:1612 -
\??\c:\ntnhhh.exec:\ntnhhh.exe18⤵
- Executes dropped EXE
PID:284 -
\??\c:\5bnttt.exec:\5bnttt.exe19⤵
- Executes dropped EXE
PID:2764 -
\??\c:\btntnn.exec:\btntnn.exe20⤵
- Executes dropped EXE
PID:2628 -
\??\c:\vpjpd.exec:\vpjpd.exe21⤵
- Executes dropped EXE
PID:952 -
\??\c:\btntbh.exec:\btntbh.exe22⤵
- Executes dropped EXE
PID:1900 -
\??\c:\fxfxfxl.exec:\fxfxfxl.exe23⤵
- Executes dropped EXE
PID:1984 -
\??\c:\1pjjp.exec:\1pjjp.exe24⤵
- Executes dropped EXE
PID:1200 -
\??\c:\jjddp.exec:\jjddp.exe25⤵
- Executes dropped EXE
PID:2136 -
\??\c:\vjdpj.exec:\vjdpj.exe26⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jdpdj.exec:\jdpdj.exe27⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vdjdd.exec:\vdjdd.exe28⤵
- Executes dropped EXE
PID:2276 -
\??\c:\fxlxrxf.exec:\fxlxrxf.exe29⤵
- Executes dropped EXE
PID:2928 -
\??\c:\thtbhn.exec:\thtbhn.exe30⤵
- Executes dropped EXE
PID:2076 -
\??\c:\5pjvj.exec:\5pjvj.exe31⤵
- Executes dropped EXE
PID:2324 -
\??\c:\5thhnn.exec:\5thhnn.exe32⤵
- Executes dropped EXE
PID:1584 -
\??\c:\9dpvd.exec:\9dpvd.exe33⤵
- Executes dropped EXE
PID:2924 -
\??\c:\7hhbnn.exec:\7hhbnn.exe34⤵
- Executes dropped EXE
PID:2868 -
\??\c:\ppjpv.exec:\ppjpv.exe35⤵
- Executes dropped EXE
PID:2400 -
\??\c:\3xrxlxl.exec:\3xrxlxl.exe36⤵
- Executes dropped EXE
PID:2660 -
\??\c:\btntbh.exec:\btntbh.exe37⤵
- Executes dropped EXE
PID:2656 -
\??\c:\dvjvj.exec:\dvjvj.exe38⤵
- Executes dropped EXE
PID:2940 -
\??\c:\vdpjv.exec:\vdpjv.exe39⤵
- Executes dropped EXE
PID:2828 -
\??\c:\1xllxfl.exec:\1xllxfl.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\nnbhnn.exec:\nnbhnn.exe41⤵
- Executes dropped EXE
PID:2124 -
\??\c:\7pjjj.exec:\7pjjj.exe42⤵
- Executes dropped EXE
PID:2528 -
\??\c:\7vppp.exec:\7vppp.exe43⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rrlxlrx.exec:\rrlxlrx.exe44⤵
- Executes dropped EXE
PID:1936 -
\??\c:\hbnnbh.exec:\hbnnbh.exe45⤵
- Executes dropped EXE
PID:1728 -
\??\c:\vpddj.exec:\vpddj.exe46⤵
- Executes dropped EXE
PID:1904 -
\??\c:\9xrxlxf.exec:\9xrxlxf.exe47⤵
- Executes dropped EXE
PID:2632 -
\??\c:\llfrxfx.exec:\llfrxfx.exe48⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hhthtb.exec:\hhthtb.exe49⤵
- Executes dropped EXE
PID:1948 -
\??\c:\jdvdj.exec:\jdvdj.exe50⤵
- Executes dropped EXE
PID:1724 -
\??\c:\5rflrxl.exec:\5rflrxl.exe51⤵
- Executes dropped EXE
PID:2600 -
\??\c:\ttntnt.exec:\ttntnt.exe52⤵
- Executes dropped EXE
PID:872 -
\??\c:\ddvdj.exec:\ddvdj.exe53⤵
- Executes dropped EXE
PID:2044 -
\??\c:\dvpvv.exec:\dvpvv.exe54⤵
- Executes dropped EXE
PID:2892 -
\??\c:\1fllrrf.exec:\1fllrrf.exe55⤵
- Executes dropped EXE
PID:2772 -
\??\c:\tnhnbh.exec:\tnhnbh.exe56⤵
- Executes dropped EXE
PID:1928 -
\??\c:\9pjpv.exec:\9pjpv.exe57⤵
- Executes dropped EXE
PID:2628 -
\??\c:\5fxlrxr.exec:\5fxlrxr.exe58⤵
- Executes dropped EXE
PID:1484 -
\??\c:\nhhnbh.exec:\nhhnbh.exe59⤵
- Executes dropped EXE
PID:1328 -
\??\c:\pjjvp.exec:\pjjvp.exe60⤵
- Executes dropped EXE
PID:348 -
\??\c:\1xxrrrx.exec:\1xxrrrx.exe61⤵
- Executes dropped EXE
PID:848 -
\??\c:\1bbnbh.exec:\1bbnbh.exe62⤵
- Executes dropped EXE
PID:1432 -
\??\c:\3bnnnh.exec:\3bnnnh.exe63⤵
- Executes dropped EXE
PID:1320 -
\??\c:\vvjvd.exec:\vvjvd.exe64⤵
- Executes dropped EXE
PID:2148 -
\??\c:\lfxlffl.exec:\lfxlffl.exe65⤵
- Executes dropped EXE
PID:2384 -
\??\c:\bnbbhn.exec:\bnbbhn.exe66⤵
- System Location Discovery: System Language Discovery
PID:1656 -
\??\c:\hhhtht.exec:\hhhtht.exe67⤵PID:988
-
\??\c:\jjjpd.exec:\jjjpd.exe68⤵PID:2184
-
\??\c:\lrrfrxf.exec:\lrrfrxf.exe69⤵PID:2928
-
\??\c:\9htntt.exec:\9htntt.exe70⤵PID:1812
-
\??\c:\5hhtnb.exec:\5hhtnb.exe71⤵PID:1688
-
\??\c:\vpjvj.exec:\vpjvj.exe72⤵PID:2120
-
\??\c:\xffrflr.exec:\xffrflr.exe73⤵PID:2472
-
\??\c:\nnnbnb.exec:\nnnbnb.exe74⤵PID:2500
-
\??\c:\hthnth.exec:\hthnth.exe75⤵
- System Location Discovery: System Language Discovery
PID:2812 -
\??\c:\pjjpp.exec:\pjjpp.exe76⤵PID:2852
-
\??\c:\llfrfrf.exec:\llfrfrf.exe77⤵PID:2840
-
\??\c:\rlflxxl.exec:\rlflxxl.exe78⤵PID:2932
-
\??\c:\hbtntt.exec:\hbtntt.exe79⤵PID:2860
-
\??\c:\jjppp.exec:\jjppp.exe80⤵PID:2700
-
\??\c:\xrrrllx.exec:\xrrrllx.exe81⤵PID:1468
-
\??\c:\rrllxfr.exec:\rrllxfr.exe82⤵PID:2580
-
\??\c:\hhbnbn.exec:\hhbnbn.exe83⤵PID:1972
-
\??\c:\vpjpv.exec:\vpjpv.exe84⤵PID:2848
-
\??\c:\rrlfrrl.exec:\rrlfrrl.exe85⤵PID:1020
-
\??\c:\bbntbh.exec:\bbntbh.exe86⤵PID:1104
-
\??\c:\hnnbnn.exec:\hnnbnn.exe87⤵PID:1708
-
\??\c:\7dvvv.exec:\7dvvv.exe88⤵PID:1596
-
\??\c:\fxxfxlr.exec:\fxxfxlr.exe89⤵PID:1392
-
\??\c:\lfxlxxf.exec:\lfxlxxf.exe90⤵PID:1036
-
\??\c:\5tnbtb.exec:\5tnbtb.exe91⤵PID:1500
-
\??\c:\ddvdv.exec:\ddvdv.exe92⤵PID:1648
-
\??\c:\xrffrrl.exec:\xrffrrl.exe93⤵PID:764
-
\??\c:\rrfrlrf.exec:\rrfrlrf.exe94⤵PID:2752
-
\??\c:\nnbnbh.exec:\nnbnbh.exe95⤵PID:2872
-
\??\c:\jjdjv.exec:\jjdjv.exe96⤵PID:2232
-
\??\c:\1llflrf.exec:\1llflrf.exe97⤵PID:2224
-
\??\c:\lxxlxfr.exec:\lxxlxfr.exe98⤵PID:1516
-
\??\c:\nhtnbh.exec:\nhtnbh.exe99⤵PID:2264
-
\??\c:\ppjpd.exec:\ppjpd.exe100⤵PID:1900
-
\??\c:\pvjvd.exec:\pvjvd.exe101⤵PID:912
-
\??\c:\7flrrrf.exec:\7flrrrf.exe102⤵PID:1528
-
\??\c:\9hbhnb.exec:\9hbhnb.exe103⤵PID:1200
-
\??\c:\ppdjp.exec:\ppdjp.exe104⤵PID:1532
-
\??\c:\rlxlxfr.exec:\rlxlxfr.exe105⤵PID:3044
-
\??\c:\hbntbh.exec:\hbntbh.exe106⤵PID:3064
-
\??\c:\hnnnhn.exec:\hnnnhn.exe107⤵PID:1616
-
\??\c:\dddvd.exec:\dddvd.exe108⤵PID:1628
-
\??\c:\9frfrrx.exec:\9frfrrx.exe109⤵PID:1744
-
\??\c:\1frxffl.exec:\1frxffl.exe110⤵PID:2424
-
\??\c:\nhbbtn.exec:\nhbbtn.exe111⤵PID:1996
-
\??\c:\3xrflxr.exec:\3xrflxr.exe112⤵PID:2064
-
\??\c:\7nbhnb.exec:\7nbhnb.exe113⤵PID:2280
-
\??\c:\nhnthn.exec:\nhnthn.exe114⤵PID:1608
-
\??\c:\vvvjv.exec:\vvvjv.exe115⤵PID:2868
-
\??\c:\fflxrxr.exec:\fflxrxr.exe116⤵PID:2792
-
\??\c:\3xrlxlx.exec:\3xrlxlx.exe117⤵PID:2812
-
\??\c:\bhbhth.exec:\bhbhth.exe118⤵PID:2640
-
\??\c:\pvvvp.exec:\pvvvp.exe119⤵PID:1312
-
\??\c:\pdvvv.exec:\pdvvv.exe120⤵PID:2884
-
\??\c:\lrlrflr.exec:\lrlrflr.exe121⤵PID:2796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-