Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 02:13
Static task
static1
Behavioral task
behavioral1
Sample
94d99496a9087ccd0cafd80fa38b5fefd22ea107e580c0c9475c1af576a570b3.exe
Resource
win7-20240729-en
General
-
Target
94d99496a9087ccd0cafd80fa38b5fefd22ea107e580c0c9475c1af576a570b3.exe
-
Size
455KB
-
MD5
d0246ea9665f16b301cd37508b7c8b78
-
SHA1
597a09e53cdcf69b04e1ee1bac61489a8fadbb18
-
SHA256
94d99496a9087ccd0cafd80fa38b5fefd22ea107e580c0c9475c1af576a570b3
-
SHA512
44ced969ddbc215c50b8931f606dd0646bf62ec1cfedc72b8099b63bd1d8b99b8baef3bc1dcb90f808c47196c75a3e9f720acb5620d9fc27e34c75613ea2d6ee
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRd:q7Tc2NYHUrAwfMp3CDRd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
Processes:
resource yara_rule behavioral1/memory/2704-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/448-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-339-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2696-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/876-552-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2996-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-565-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2844-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-609-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2112-666-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-694-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1708-722-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-721-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2448-736-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1740-804-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-844-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2388-886-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xxllrrr.exebtbhth.exejdppj.exe9dvdj.exellxxffl.exe5thntb.exe5xllrff.exe3hbntb.exexrrxxxf.exeddvdd.exellxfllr.exebbnbhh.exexxlxlrr.exehbnnth.exe7httbt.exe1tnhtn.exexrxxxfl.exebhntbt.exennbbhn.exe7xfffxf.exebtnntb.exerxrxlxf.exe9nhthb.exe5jvdd.exexrrrrxr.exevvdvv.exe9lfxfrx.exe1pjdv.exettbbhh.exejjpjj.exellxxxxf.exe3tbttb.exedvdvd.exellrrrlr.exenbnhhh.exe9jpvp.exeflxfllx.exebtbtnh.exevdvvd.exe7xxxlfr.exexxffxxx.exehhnnhh.exejjvvv.exerllllll.exellrlrlr.exe1ntttt.exevpdjp.exexlxxxfx.exelflrxfl.exehbnntn.exepjdjv.exerxllllr.exe7llrrrf.exe1tbbbb.exedjvvp.exejjjjj.exexflfffl.exehbhhhh.exe9vjdj.exejdjjp.exerrfllrx.exehnbbnh.exejjdjv.exefffxflr.exepid Process 2788 xxllrrr.exe 2836 btbhth.exe 2360 jdppj.exe 2164 9dvdj.exe 2576 llxxffl.exe 2696 5thntb.exe 2568 5xllrff.exe 2324 3hbntb.exe 2148 xrrxxxf.exe 448 ddvdd.exe 2032 llxfllr.exe 1796 bbnbhh.exe 1456 xxlxlrr.exe 1424 hbnnth.exe 1688 7httbt.exe 1876 1tnhtn.exe 1768 xrxxxfl.exe 320 bhntbt.exe 2348 nnbbhn.exe 3064 7xfffxf.exe 852 btnntb.exe 976 rxrxlxf.exe 1696 9nhthb.exe 904 5jvdd.exe 1948 xrrrrxr.exe 2492 vvdvv.exe 1944 9lfxfrx.exe 1572 1pjdv.exe 2936 ttbbhh.exe 876 jjpjj.exe 2964 llxxxxf.exe 2828 3tbttb.exe 2852 dvdvd.exe 2932 llrrrlr.exe 2836 nbnhhh.exe 2752 9jpvp.exe 2628 flxfllx.exe 2592 btbtnh.exe 3012 vdvvd.exe 2696 7xxxlfr.exe 2200 xxffxxx.exe 1904 hhnnhh.exe 2324 jjvvv.exe 2176 rllllll.exe 2216 llrlrlr.exe 2408 1ntttt.exe 2560 vpdjp.exe 2676 xlxxxfx.exe 1976 lflrxfl.exe 1920 hbnntn.exe 2136 pjdjv.exe 2556 rxllllr.exe 772 7llrrrf.exe 2252 1tbbbb.exe 2192 djvvp.exe 2356 jjjjj.exe 2448 xflfffl.exe 2416 hbhhhh.exe 652 9vjdj.exe 1176 jdjjp.exe 1960 rrfllrx.exe 1744 hnbbnh.exe 1436 jjdjv.exe 1964 fffxflr.exe -
Processes:
resource yara_rule behavioral1/memory/2704-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-300-0x00000000005C0000-0x00000000005EA000-memory.dmp upx behavioral1/memory/2932-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-565-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2844-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-592-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2712-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-804-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-830-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-842-0x0000000000320000-0x000000000034A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ttbbbb.exetntbhn.exe7fxflrf.exe1lxrxrx.exe1pjvd.exejjjpp.exerrfxffr.exejvjjj.exe1xlllfl.exettnhbb.exepdjdv.exevvdjj.exedppjj.exexxxfxrr.exe7frlrfl.exejdjvj.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frlrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
94d99496a9087ccd0cafd80fa38b5fefd22ea107e580c0c9475c1af576a570b3.exexxllrrr.exebtbhth.exejdppj.exe9dvdj.exellxxffl.exe5thntb.exe5xllrff.exe3hbntb.exexrrxxxf.exeddvdd.exellxfllr.exebbnbhh.exexxlxlrr.exehbnnth.exe7httbt.exedescription pid Process procid_target PID 2704 wrote to memory of 2788 2704 94d99496a9087ccd0cafd80fa38b5fefd22ea107e580c0c9475c1af576a570b3.exe 30 PID 2704 wrote to memory of 2788 2704 94d99496a9087ccd0cafd80fa38b5fefd22ea107e580c0c9475c1af576a570b3.exe 30 PID 2704 wrote to memory of 2788 2704 94d99496a9087ccd0cafd80fa38b5fefd22ea107e580c0c9475c1af576a570b3.exe 30 PID 2704 wrote to memory of 2788 2704 94d99496a9087ccd0cafd80fa38b5fefd22ea107e580c0c9475c1af576a570b3.exe 30 PID 2788 wrote to memory of 2836 2788 xxllrrr.exe 31 PID 2788 wrote to memory of 2836 2788 xxllrrr.exe 31 PID 2788 wrote to memory of 2836 2788 xxllrrr.exe 31 PID 2788 wrote to memory of 2836 2788 xxllrrr.exe 31 PID 2836 wrote to memory of 2360 2836 btbhth.exe 32 PID 2836 wrote to memory of 2360 2836 btbhth.exe 32 PID 2836 wrote to memory of 2360 2836 btbhth.exe 32 PID 2836 wrote to memory of 2360 2836 btbhth.exe 32 PID 2360 wrote to memory of 2164 2360 jdppj.exe 33 PID 2360 wrote to memory of 2164 2360 jdppj.exe 33 PID 2360 wrote to memory of 2164 2360 jdppj.exe 33 PID 2360 wrote to memory of 2164 2360 jdppj.exe 33 PID 2164 wrote to memory of 2576 2164 9dvdj.exe 34 PID 2164 wrote to memory of 2576 2164 9dvdj.exe 34 PID 2164 wrote to memory of 2576 2164 9dvdj.exe 34 PID 2164 wrote to memory of 2576 2164 9dvdj.exe 34 PID 2576 wrote to memory of 2696 2576 llxxffl.exe 35 PID 2576 wrote to memory of 2696 2576 llxxffl.exe 35 PID 2576 wrote to memory of 2696 2576 llxxffl.exe 35 PID 2576 wrote to memory of 2696 2576 llxxffl.exe 35 PID 2696 wrote to memory of 2568 2696 5thntb.exe 36 PID 2696 wrote to memory of 2568 2696 5thntb.exe 36 PID 2696 wrote to memory of 2568 2696 5thntb.exe 36 PID 2696 wrote to memory of 2568 2696 5thntb.exe 36 PID 2568 wrote to memory of 2324 2568 5xllrff.exe 37 PID 2568 wrote to memory of 2324 2568 5xllrff.exe 37 PID 2568 wrote to memory of 2324 2568 5xllrff.exe 37 PID 2568 wrote to memory of 2324 2568 5xllrff.exe 37 PID 2324 wrote to memory of 2148 2324 3hbntb.exe 38 PID 2324 wrote to memory of 2148 2324 3hbntb.exe 38 PID 2324 wrote to memory of 2148 2324 3hbntb.exe 38 PID 2324 wrote to memory of 2148 2324 3hbntb.exe 38 PID 2148 wrote to memory of 448 2148 xrrxxxf.exe 39 PID 2148 wrote to memory of 448 2148 xrrxxxf.exe 39 PID 2148 wrote to memory of 448 2148 xrrxxxf.exe 39 PID 2148 wrote to memory of 448 2148 xrrxxxf.exe 39 PID 448 wrote to memory of 2032 448 ddvdd.exe 40 PID 448 wrote to memory of 2032 448 ddvdd.exe 40 PID 448 wrote to memory of 2032 448 ddvdd.exe 40 PID 448 wrote to memory of 2032 448 ddvdd.exe 40 PID 2032 wrote to memory of 1796 2032 llxfllr.exe 41 PID 2032 wrote to memory of 1796 2032 llxfllr.exe 41 PID 2032 wrote to memory of 1796 2032 llxfllr.exe 41 PID 2032 wrote to memory of 1796 2032 llxfllr.exe 41 PID 1796 wrote to memory of 1456 1796 bbnbhh.exe 42 PID 1796 wrote to memory of 1456 1796 bbnbhh.exe 42 PID 1796 wrote to memory of 1456 1796 bbnbhh.exe 42 PID 1796 wrote to memory of 1456 1796 bbnbhh.exe 42 PID 1456 wrote to memory of 1424 1456 xxlxlrr.exe 43 PID 1456 wrote to memory of 1424 1456 xxlxlrr.exe 43 PID 1456 wrote to memory of 1424 1456 xxlxlrr.exe 43 PID 1456 wrote to memory of 1424 1456 xxlxlrr.exe 43 PID 1424 wrote to memory of 1688 1424 hbnnth.exe 44 PID 1424 wrote to memory of 1688 1424 hbnnth.exe 44 PID 1424 wrote to memory of 1688 1424 hbnnth.exe 44 PID 1424 wrote to memory of 1688 1424 hbnnth.exe 44 PID 1688 wrote to memory of 1876 1688 7httbt.exe 45 PID 1688 wrote to memory of 1876 1688 7httbt.exe 45 PID 1688 wrote to memory of 1876 1688 7httbt.exe 45 PID 1688 wrote to memory of 1876 1688 7httbt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\94d99496a9087ccd0cafd80fa38b5fefd22ea107e580c0c9475c1af576a570b3.exe"C:\Users\Admin\AppData\Local\Temp\94d99496a9087ccd0cafd80fa38b5fefd22ea107e580c0c9475c1af576a570b3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\xxllrrr.exec:\xxllrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\btbhth.exec:\btbhth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\jdppj.exec:\jdppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\9dvdj.exec:\9dvdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\llxxffl.exec:\llxxffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\5thntb.exec:\5thntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\5xllrff.exec:\5xllrff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\3hbntb.exec:\3hbntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\xrrxxxf.exec:\xrrxxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\ddvdd.exec:\ddvdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\llxfllr.exec:\llxfllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\bbnbhh.exec:\bbnbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\xxlxlrr.exec:\xxlxlrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\hbnnth.exec:\hbnnth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\7httbt.exec:\7httbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\1tnhtn.exec:\1tnhtn.exe17⤵
- Executes dropped EXE
PID:1876 -
\??\c:\xrxxxfl.exec:\xrxxxfl.exe18⤵
- Executes dropped EXE
PID:1768 -
\??\c:\bhntbt.exec:\bhntbt.exe19⤵
- Executes dropped EXE
PID:320 -
\??\c:\nnbbhn.exec:\nnbbhn.exe20⤵
- Executes dropped EXE
PID:2348 -
\??\c:\7xfffxf.exec:\7xfffxf.exe21⤵
- Executes dropped EXE
PID:3064 -
\??\c:\btnntb.exec:\btnntb.exe22⤵
- Executes dropped EXE
PID:852 -
\??\c:\rxrxlxf.exec:\rxrxlxf.exe23⤵
- Executes dropped EXE
PID:976 -
\??\c:\9nhthb.exec:\9nhthb.exe24⤵
- Executes dropped EXE
PID:1696 -
\??\c:\5jvdd.exec:\5jvdd.exe25⤵
- Executes dropped EXE
PID:904 -
\??\c:\xrrrrxr.exec:\xrrrrxr.exe26⤵
- Executes dropped EXE
PID:1948 -
\??\c:\vvdvv.exec:\vvdvv.exe27⤵
- Executes dropped EXE
PID:2492 -
\??\c:\9lfxfrx.exec:\9lfxfrx.exe28⤵
- Executes dropped EXE
PID:1944 -
\??\c:\1pjdv.exec:\1pjdv.exe29⤵
- Executes dropped EXE
PID:1572 -
\??\c:\ttbbhh.exec:\ttbbhh.exe30⤵
- Executes dropped EXE
PID:2936 -
\??\c:\jjpjj.exec:\jjpjj.exe31⤵
- Executes dropped EXE
PID:876 -
\??\c:\llxxxxf.exec:\llxxxxf.exe32⤵
- Executes dropped EXE
PID:2964 -
\??\c:\3tbttb.exec:\3tbttb.exe33⤵
- Executes dropped EXE
PID:2828 -
\??\c:\dvdvd.exec:\dvdvd.exe34⤵
- Executes dropped EXE
PID:2852 -
\??\c:\llrrrlr.exec:\llrrrlr.exe35⤵
- Executes dropped EXE
PID:2932 -
\??\c:\nbnhhh.exec:\nbnhhh.exe36⤵
- Executes dropped EXE
PID:2836 -
\??\c:\9jpvp.exec:\9jpvp.exe37⤵
- Executes dropped EXE
PID:2752 -
\??\c:\flxfllx.exec:\flxfllx.exe38⤵
- Executes dropped EXE
PID:2628 -
\??\c:\btbtnh.exec:\btbtnh.exe39⤵
- Executes dropped EXE
PID:2592 -
\??\c:\vdvvd.exec:\vdvvd.exe40⤵
- Executes dropped EXE
PID:3012 -
\??\c:\7xxxlfr.exec:\7xxxlfr.exe41⤵
- Executes dropped EXE
PID:2696 -
\??\c:\xxffxxx.exec:\xxffxxx.exe42⤵
- Executes dropped EXE
PID:2200 -
\??\c:\hhnnhh.exec:\hhnnhh.exe43⤵
- Executes dropped EXE
PID:1904 -
\??\c:\jjvvv.exec:\jjvvv.exe44⤵
- Executes dropped EXE
PID:2324 -
\??\c:\rllllll.exec:\rllllll.exe45⤵
- Executes dropped EXE
PID:2176 -
\??\c:\llrlrlr.exec:\llrlrlr.exe46⤵
- Executes dropped EXE
PID:2216 -
\??\c:\1ntttt.exec:\1ntttt.exe47⤵
- Executes dropped EXE
PID:2408 -
\??\c:\vpdjp.exec:\vpdjp.exe48⤵
- Executes dropped EXE
PID:2560 -
\??\c:\xlxxxfx.exec:\xlxxxfx.exe49⤵
- Executes dropped EXE
PID:2676 -
\??\c:\lflrxfl.exec:\lflrxfl.exe50⤵
- Executes dropped EXE
PID:1976 -
\??\c:\hbnntn.exec:\hbnntn.exe51⤵
- Executes dropped EXE
PID:1920 -
\??\c:\pjdjv.exec:\pjdjv.exe52⤵
- Executes dropped EXE
PID:2136 -
\??\c:\rxllllr.exec:\rxllllr.exe53⤵
- Executes dropped EXE
PID:2556 -
\??\c:\7llrrrf.exec:\7llrrrf.exe54⤵
- Executes dropped EXE
PID:772 -
\??\c:\1tbbbb.exec:\1tbbbb.exe55⤵
- Executes dropped EXE
PID:2252 -
\??\c:\djvvp.exec:\djvvp.exe56⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jjjjj.exec:\jjjjj.exe57⤵
- Executes dropped EXE
PID:2356 -
\??\c:\xflfffl.exec:\xflfffl.exe58⤵
- Executes dropped EXE
PID:2448 -
\??\c:\hbhhhh.exec:\hbhhhh.exe59⤵
- Executes dropped EXE
PID:2416 -
\??\c:\9vjdj.exec:\9vjdj.exe60⤵
- Executes dropped EXE
PID:652 -
\??\c:\jdjjp.exec:\jdjjp.exe61⤵
- Executes dropped EXE
PID:1176 -
\??\c:\rrfllrx.exec:\rrfllrx.exe62⤵
- Executes dropped EXE
PID:1960 -
\??\c:\hnbbnh.exec:\hnbbnh.exe63⤵
- Executes dropped EXE
PID:1744 -
\??\c:\jjdjv.exec:\jjdjv.exe64⤵
- Executes dropped EXE
PID:1436 -
\??\c:\fffxflr.exec:\fffxflr.exe65⤵
- Executes dropped EXE
PID:1964 -
\??\c:\5xrffll.exec:\5xrffll.exe66⤵PID:2976
-
\??\c:\bthnbh.exec:\bthnbh.exe67⤵PID:2508
-
\??\c:\pdpvj.exec:\pdpvj.exe68⤵PID:2296
-
\??\c:\rllffxf.exec:\rllffxf.exe69⤵PID:3028
-
\??\c:\rxlfffl.exec:\rxlfffl.exe70⤵PID:1008
-
\??\c:\tnbntt.exec:\tnbntt.exe71⤵PID:1560
-
\??\c:\7dpvv.exec:\7dpvv.exe72⤵PID:2120
-
\??\c:\dvdvp.exec:\dvdvp.exe73⤵PID:876
-
\??\c:\xxrrrll.exec:\xxrrrll.exe74⤵PID:2996
-
\??\c:\9hnnnh.exec:\9hnnnh.exe75⤵PID:1652
-
\??\c:\7dddv.exec:\7dddv.exe76⤵PID:2800
-
\??\c:\jdddj.exec:\jdddj.exe77⤵PID:2844
-
\??\c:\llfflxf.exec:\llfflxf.exe78⤵PID:2664
-
\??\c:\3htnhn.exec:\3htnhn.exe79⤵PID:2748
-
\??\c:\5bthth.exec:\5bthth.exe80⤵PID:2712
-
\??\c:\3pdpp.exec:\3pdpp.exe81⤵PID:3016
-
\??\c:\3rrfxfr.exec:\3rrfxfr.exe82⤵PID:1916
-
\??\c:\xlxflrx.exec:\xlxflrx.exe83⤵PID:276
-
\??\c:\nnttbh.exec:\nnttbh.exe84⤵PID:2020
-
\??\c:\ddppp.exec:\ddppp.exe85⤵PID:2948
-
\??\c:\3llfrxr.exec:\3llfrxr.exe86⤵PID:2368
-
\??\c:\5xlflll.exec:\5xlflll.exe87⤵PID:448
-
\??\c:\hhbbtb.exec:\hhbbtb.exe88⤵PID:2204
-
\??\c:\1btnhh.exec:\1btnhh.exe89⤵PID:2820
-
\??\c:\dvvpp.exec:\dvvpp.exe90⤵PID:2112
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe91⤵PID:2676
-
\??\c:\9hhnnt.exec:\9hhnnt.exe92⤵PID:1952
-
\??\c:\nnhbhb.exec:\nnhbhb.exe93⤵PID:2524
-
\??\c:\9pjjv.exec:\9pjjv.exe94⤵PID:1760
-
\??\c:\xrfflfr.exec:\xrfflfr.exe95⤵PID:1876
-
\??\c:\ttbhtn.exec:\ttbhtn.exe96⤵PID:264
-
\??\c:\hhhhnh.exec:\hhhhnh.exe97⤵PID:1708
-
\??\c:\pvpvd.exec:\pvpvd.exe98⤵PID:1056
-
\??\c:\xxfxfrf.exec:\xxfxfrf.exe99⤵PID:2448
-
\??\c:\1hnhnn.exec:\1hnhnn.exe100⤵PID:1704
-
\??\c:\7hhhhh.exec:\7hhhhh.exe101⤵PID:588
-
\??\c:\djvvv.exec:\djvvv.exe102⤵PID:1988
-
\??\c:\ffllfff.exec:\ffllfff.exe103⤵PID:1500
-
\??\c:\nhnnhh.exec:\nhnnhh.exe104⤵PID:2544
-
\??\c:\hhbbbt.exec:\hhbbbt.exe105⤵PID:1216
-
\??\c:\pjvvv.exec:\pjvvv.exe106⤵PID:684
-
\??\c:\llxxxxf.exec:\llxxxxf.exe107⤵PID:1996
-
\??\c:\5htbnn.exec:\5htbnn.exe108⤵PID:3048
-
\??\c:\hhnntt.exec:\hhnntt.exe109⤵PID:1616
-
\??\c:\dvdvv.exec:\dvdvv.exe110⤵PID:1740
-
\??\c:\9rxrllf.exec:\9rxrllf.exe111⤵PID:1584
-
\??\c:\flxxxxf.exec:\flxxxxf.exe112⤵PID:2120
-
\??\c:\tttbbb.exec:\tttbbb.exe113⤵PID:1544
-
\??\c:\ddjpd.exec:\ddjpd.exe114⤵PID:2776
-
\??\c:\fflrxfl.exec:\fflrxfl.exe115⤵PID:1652
-
\??\c:\ffrrrxl.exec:\ffrrrxl.exe116⤵PID:2832
-
\??\c:\9hbnbb.exec:\9hbnbb.exe117⤵PID:2736
-
\??\c:\1vddd.exec:\1vddd.exe118⤵PID:2596
-
\??\c:\ppvvv.exec:\ppvvv.exe119⤵PID:2748
-
\??\c:\1flllrf.exec:\1flllrf.exe120⤵PID:2712
-
\??\c:\hhtntn.exec:\hhtntn.exe121⤵PID:3020
-
\??\c:\pvjjp.exec:\pvjjp.exe122⤵PID:2388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-