Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 22:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bc0e342580e9985a967f09cf6fe250f9d99b05282800e682fa59174e3e34507c.exe
Resource
win7-20240729-en
7 signatures
120 seconds
General
-
Target
bc0e342580e9985a967f09cf6fe250f9d99b05282800e682fa59174e3e34507c.exe
-
Size
456KB
-
MD5
9a0acb46e58a2e5731df6b5bc09a3f32
-
SHA1
d263d4b927971896eb1fef2f05f5c3248da290ee
-
SHA256
bc0e342580e9985a967f09cf6fe250f9d99b05282800e682fa59174e3e34507c
-
SHA512
33e1782f8a7d064daa2f0d948dbfe1cee6d993eadf0fabacdb1011bef693baef211ccdb097816e3572d66c11acca208c2f825478d491bec1755e4b264bd6f0bd
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRc:q7Tc2NYHUrAwfMp3CDRc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2684-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-65-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2632-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/352-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-165-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/696-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/812-191-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1808-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1012-215-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2084-228-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1288-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1128-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/964-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-312-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2708-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-370-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/3024-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/856-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-385-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/580-390-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/308-408-0x0000000001C80000-0x0000000001CAA000-memory.dmp family_blackmoon behavioral1/memory/2116-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-449-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1928-462-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2888-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-610-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1496-672-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1876-714-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-721-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1376-728-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2732 vvvdd.exe 2728 pdjdv.exe 2832 bthnbb.exe 2880 dppjj.exe 2744 bbntbt.exe 2640 dpjvj.exe 2632 ffrfrxl.exe 592 nhbntn.exe 2764 9dddd.exe 1956 fffflxl.exe 1140 pjpdd.exe 352 flfrfrl.exe 2636 vddvd.exe 1636 hntnhh.exe 1888 bntntb.exe 2468 lxlxlrl.exe 696 bbtbnh.exe 2236 1llxrfr.exe 2036 vjdpv.exe 812 llxlxlr.exe 1864 rrlfrxx.exe 1808 tnnbnh.exe 1012 rlflrfx.exe 2084 bhbhth.exe 1288 xrxffrx.exe 1672 dppdv.exe 2488 bhbhbn.exe 1128 jpdvv.exe 3040 hhtnnh.exe 2312 3vjdj.exe 964 bhbnnt.exe 2984 vdpvj.exe 1544 7ppdp.exe 2808 xxxlffx.exe 2708 bhbnnt.exe 2728 1ddvp.exe 2600 rrlfxff.exe 2740 hbbhbh.exe 2688 xflfrxl.exe 2592 3htbht.exe 580 vdpvd.exe 3024 lrfrfll.exe 856 hhbhth.exe 2148 9jddp.exe 2376 llrxfrf.exe 2208 bhhttn.exe 308 jjpdj.exe 1592 lfxxllr.exe 2116 ttnntb.exe 2644 9pjvj.exe 1124 hbbnnn.exe 1888 5pjpj.exe 2268 jvdjd.exe 604 nthhtb.exe 1928 djvvj.exe 1788 xxrfrff.exe 2232 ttnbhb.exe 2088 jpppv.exe 1568 xxflxxr.exe 324 hbtnbh.exe 920 bhbhtt.exe 2888 vddpd.exe 1292 thbbnn.exe 904 1hhtnb.exe -
resource yara_rule behavioral1/memory/2684-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/964-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-385-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2116-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-449-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2888-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-590-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2836-610-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2688-638-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2372-679-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1876-714-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxlxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2684 wrote to memory of 2732 2684 bc0e342580e9985a967f09cf6fe250f9d99b05282800e682fa59174e3e34507c.exe 30 PID 2684 wrote to memory of 2732 2684 bc0e342580e9985a967f09cf6fe250f9d99b05282800e682fa59174e3e34507c.exe 30 PID 2684 wrote to memory of 2732 2684 bc0e342580e9985a967f09cf6fe250f9d99b05282800e682fa59174e3e34507c.exe 30 PID 2684 wrote to memory of 2732 2684 bc0e342580e9985a967f09cf6fe250f9d99b05282800e682fa59174e3e34507c.exe 30 PID 2732 wrote to memory of 2728 2732 vvvdd.exe 31 PID 2732 wrote to memory of 2728 2732 vvvdd.exe 31 PID 2732 wrote to memory of 2728 2732 vvvdd.exe 31 PID 2732 wrote to memory of 2728 2732 vvvdd.exe 31 PID 2728 wrote to memory of 2832 2728 pdjdv.exe 32 PID 2728 wrote to memory of 2832 2728 pdjdv.exe 32 PID 2728 wrote to memory of 2832 2728 pdjdv.exe 32 PID 2728 wrote to memory of 2832 2728 pdjdv.exe 32 PID 2832 wrote to memory of 2880 2832 bthnbb.exe 33 PID 2832 wrote to memory of 2880 2832 bthnbb.exe 33 PID 2832 wrote to memory of 2880 2832 bthnbb.exe 33 PID 2832 wrote to memory of 2880 2832 bthnbb.exe 33 PID 2880 wrote to memory of 2744 2880 dppjj.exe 34 PID 2880 wrote to memory of 2744 2880 dppjj.exe 34 PID 2880 wrote to memory of 2744 2880 dppjj.exe 34 PID 2880 wrote to memory of 2744 2880 dppjj.exe 34 PID 2744 wrote to memory of 2640 2744 bbntbt.exe 35 PID 2744 wrote to memory of 2640 2744 bbntbt.exe 35 PID 2744 wrote to memory of 2640 2744 bbntbt.exe 35 PID 2744 wrote to memory of 2640 2744 bbntbt.exe 35 PID 2640 wrote to memory of 2632 2640 dpjvj.exe 36 PID 2640 wrote to memory of 2632 2640 dpjvj.exe 36 PID 2640 wrote to memory of 2632 2640 dpjvj.exe 36 PID 2640 wrote to memory of 2632 2640 dpjvj.exe 36 PID 2632 wrote to memory of 592 2632 ffrfrxl.exe 37 PID 2632 wrote to memory of 592 2632 ffrfrxl.exe 37 PID 2632 wrote to memory of 592 2632 ffrfrxl.exe 37 PID 2632 wrote to memory of 592 2632 ffrfrxl.exe 37 PID 592 wrote to memory of 2764 592 nhbntn.exe 38 PID 592 wrote to memory of 2764 592 nhbntn.exe 38 PID 592 wrote to memory of 2764 592 nhbntn.exe 38 PID 592 wrote to memory of 2764 592 nhbntn.exe 38 PID 2764 wrote to memory of 1956 2764 9dddd.exe 39 PID 2764 wrote to memory of 1956 2764 9dddd.exe 39 PID 2764 wrote to memory of 1956 2764 9dddd.exe 39 PID 2764 wrote to memory of 1956 2764 9dddd.exe 39 PID 1956 wrote to memory of 1140 1956 fffflxl.exe 40 PID 1956 wrote to memory of 1140 1956 fffflxl.exe 40 PID 1956 wrote to memory of 1140 1956 fffflxl.exe 40 PID 1956 wrote to memory of 1140 1956 fffflxl.exe 40 PID 1140 wrote to memory of 352 1140 pjpdd.exe 41 PID 1140 wrote to memory of 352 1140 pjpdd.exe 41 PID 1140 wrote to memory of 352 1140 pjpdd.exe 41 PID 1140 wrote to memory of 352 1140 pjpdd.exe 41 PID 352 wrote to memory of 2636 352 flfrfrl.exe 42 PID 352 wrote to memory of 2636 352 flfrfrl.exe 42 PID 352 wrote to memory of 2636 352 flfrfrl.exe 42 PID 352 wrote to memory of 2636 352 flfrfrl.exe 42 PID 2636 wrote to memory of 1636 2636 vddvd.exe 43 PID 2636 wrote to memory of 1636 2636 vddvd.exe 43 PID 2636 wrote to memory of 1636 2636 vddvd.exe 43 PID 2636 wrote to memory of 1636 2636 vddvd.exe 43 PID 1636 wrote to memory of 1888 1636 hntnhh.exe 44 PID 1636 wrote to memory of 1888 1636 hntnhh.exe 44 PID 1636 wrote to memory of 1888 1636 hntnhh.exe 44 PID 1636 wrote to memory of 1888 1636 hntnhh.exe 44 PID 1888 wrote to memory of 2468 1888 bntntb.exe 45 PID 1888 wrote to memory of 2468 1888 bntntb.exe 45 PID 1888 wrote to memory of 2468 1888 bntntb.exe 45 PID 1888 wrote to memory of 2468 1888 bntntb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc0e342580e9985a967f09cf6fe250f9d99b05282800e682fa59174e3e34507c.exe"C:\Users\Admin\AppData\Local\Temp\bc0e342580e9985a967f09cf6fe250f9d99b05282800e682fa59174e3e34507c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\vvvdd.exec:\vvvdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\pdjdv.exec:\pdjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\bthnbb.exec:\bthnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\dppjj.exec:\dppjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\bbntbt.exec:\bbntbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\dpjvj.exec:\dpjvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\ffrfrxl.exec:\ffrfrxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\nhbntn.exec:\nhbntn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\9dddd.exec:\9dddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\fffflxl.exec:\fffflxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\pjpdd.exec:\pjpdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\flfrfrl.exec:\flfrfrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\vddvd.exec:\vddvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\hntnhh.exec:\hntnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\bntntb.exec:\bntntb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\lxlxlrl.exec:\lxlxlrl.exe17⤵
- Executes dropped EXE
PID:2468 -
\??\c:\bbtbnh.exec:\bbtbnh.exe18⤵
- Executes dropped EXE
PID:696 -
\??\c:\1llxrfr.exec:\1llxrfr.exe19⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vjdpv.exec:\vjdpv.exe20⤵
- Executes dropped EXE
PID:2036 -
\??\c:\llxlxlr.exec:\llxlxlr.exe21⤵
- Executes dropped EXE
PID:812 -
\??\c:\rrlfrxx.exec:\rrlfrxx.exe22⤵
- Executes dropped EXE
PID:1864 -
\??\c:\tnnbnh.exec:\tnnbnh.exe23⤵
- Executes dropped EXE
PID:1808 -
\??\c:\rlflrfx.exec:\rlflrfx.exe24⤵
- Executes dropped EXE
PID:1012 -
\??\c:\bhbhth.exec:\bhbhth.exe25⤵
- Executes dropped EXE
PID:2084 -
\??\c:\xrxffrx.exec:\xrxffrx.exe26⤵
- Executes dropped EXE
PID:1288 -
\??\c:\dppdv.exec:\dppdv.exe27⤵
- Executes dropped EXE
PID:1672 -
\??\c:\bhbhbn.exec:\bhbhbn.exe28⤵
- Executes dropped EXE
PID:2488 -
\??\c:\jpdvv.exec:\jpdvv.exe29⤵
- Executes dropped EXE
PID:1128 -
\??\c:\hhtnnh.exec:\hhtnnh.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3040 -
\??\c:\3vjdj.exec:\3vjdj.exe31⤵
- Executes dropped EXE
PID:2312 -
\??\c:\bhbnnt.exec:\bhbnnt.exe32⤵
- Executes dropped EXE
PID:964 -
\??\c:\vdpvj.exec:\vdpvj.exe33⤵
- Executes dropped EXE
PID:2984 -
\??\c:\7ppdp.exec:\7ppdp.exe34⤵
- Executes dropped EXE
PID:1544 -
\??\c:\xxxlffx.exec:\xxxlffx.exe35⤵
- Executes dropped EXE
PID:2808 -
\??\c:\bhbnnt.exec:\bhbnnt.exe36⤵
- Executes dropped EXE
PID:2708 -
\??\c:\1ddvp.exec:\1ddvp.exe37⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rrlfxff.exec:\rrlfxff.exe38⤵
- Executes dropped EXE
PID:2600 -
\??\c:\hbbhbh.exec:\hbbhbh.exe39⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xflfrxl.exec:\xflfrxl.exe40⤵
- Executes dropped EXE
PID:2688 -
\??\c:\3htbht.exec:\3htbht.exe41⤵
- Executes dropped EXE
PID:2592 -
\??\c:\vdpvd.exec:\vdpvd.exe42⤵
- Executes dropped EXE
PID:580 -
\??\c:\lrfrfll.exec:\lrfrfll.exe43⤵
- Executes dropped EXE
PID:3024 -
\??\c:\hhbhth.exec:\hhbhth.exe44⤵
- Executes dropped EXE
PID:856 -
\??\c:\9jddp.exec:\9jddp.exe45⤵
- Executes dropped EXE
PID:2148 -
\??\c:\llrxfrf.exec:\llrxfrf.exe46⤵
- Executes dropped EXE
PID:2376 -
\??\c:\bhhttn.exec:\bhhttn.exe47⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jjpdj.exec:\jjpdj.exe48⤵
- Executes dropped EXE
PID:308 -
\??\c:\lfxxllr.exec:\lfxxllr.exe49⤵
- Executes dropped EXE
PID:1592 -
\??\c:\ttnntb.exec:\ttnntb.exe50⤵
- Executes dropped EXE
PID:2116 -
\??\c:\9pjvj.exec:\9pjvj.exe51⤵
- Executes dropped EXE
PID:2644 -
\??\c:\hbbnnn.exec:\hbbnnn.exe52⤵
- Executes dropped EXE
PID:1124 -
\??\c:\5pjpj.exec:\5pjpj.exe53⤵
- Executes dropped EXE
PID:1888 -
\??\c:\jvdjd.exec:\jvdjd.exe54⤵
- Executes dropped EXE
PID:2268 -
\??\c:\nthhtb.exec:\nthhtb.exe55⤵
- Executes dropped EXE
PID:604 -
\??\c:\djvvj.exec:\djvvj.exe56⤵
- Executes dropped EXE
PID:1928 -
\??\c:\xxrfrff.exec:\xxrfrff.exe57⤵
- Executes dropped EXE
PID:1788 -
\??\c:\ttnbhb.exec:\ttnbhb.exe58⤵
- Executes dropped EXE
PID:2232 -
\??\c:\jpppv.exec:\jpppv.exe59⤵
- Executes dropped EXE
PID:2088 -
\??\c:\xxflxxr.exec:\xxflxxr.exe60⤵
- Executes dropped EXE
PID:1568 -
\??\c:\hbtnbh.exec:\hbtnbh.exe61⤵
- Executes dropped EXE
PID:324 -
\??\c:\bhbhtt.exec:\bhbhtt.exe62⤵
- Executes dropped EXE
PID:920 -
\??\c:\vddpd.exec:\vddpd.exe63⤵
- Executes dropped EXE
PID:2888 -
\??\c:\thbbnn.exec:\thbbnn.exe64⤵
- Executes dropped EXE
PID:1292 -
\??\c:\1hhtnb.exec:\1hhtnb.exe65⤵
- Executes dropped EXE
PID:904 -
\??\c:\ddvdp.exec:\ddvdp.exe66⤵PID:1684
-
\??\c:\rxxfrxl.exec:\rxxfrxl.exe67⤵PID:2976
-
\??\c:\hhhntn.exec:\hhhntn.exe68⤵PID:2344
-
\??\c:\7pjpj.exec:\7pjpj.exe69⤵PID:1060
-
\??\c:\xxlrfrf.exec:\xxlrfrf.exe70⤵PID:708
-
\??\c:\hnbhbt.exec:\hnbhbt.exe71⤵PID:3040
-
\??\c:\nnttht.exec:\nnttht.exe72⤵PID:1812
-
\??\c:\3vvdp.exec:\3vvdp.exe73⤵
- System Location Discovery: System Language Discovery
PID:2996 -
\??\c:\lfxxllx.exec:\lfxxllx.exe74⤵PID:2684
-
\??\c:\5hbhnn.exec:\5hbhnn.exe75⤵PID:2916
-
\??\c:\hhtbnt.exec:\hhtbnt.exe76⤵PID:1548
-
\??\c:\5dpvp.exec:\5dpvp.exe77⤵PID:2808
-
\??\c:\rrffxlf.exec:\rrffxlf.exe78⤵PID:2836
-
\??\c:\3btbtn.exec:\3btbtn.exe79⤵PID:2360
-
\??\c:\vdvpv.exec:\vdvpv.exe80⤵PID:2748
-
\??\c:\llxlfxr.exec:\llxlfxr.exe81⤵PID:2768
-
\??\c:\hhhtbh.exec:\hhhtbh.exe82⤵PID:2688
-
\??\c:\pjpdj.exec:\pjpdj.exe83⤵PID:2584
-
\??\c:\llfrxff.exec:\llfrxff.exe84⤵PID:1496
-
\??\c:\thnbbn.exec:\thnbbn.exe85⤵PID:1464
-
\??\c:\dpdvj.exec:\dpdvj.exe86⤵PID:2960
-
\??\c:\rrrfrxl.exec:\rrrfrxl.exe87⤵PID:2368
-
\??\c:\nthtbh.exec:\nthtbh.exe88⤵PID:2372
-
\??\c:\tnhbtt.exec:\tnhbtt.exe89⤵PID:640
-
\??\c:\dvvdv.exec:\dvvdv.exe90⤵PID:1096
-
\??\c:\fllxrrx.exec:\fllxrrx.exe91⤵PID:2676
-
\??\c:\thttht.exec:\thttht.exe92⤵PID:1376
-
\??\c:\vvddj.exec:\vvddj.exe93⤵PID:1876
-
\??\c:\fffxrlf.exec:\fffxrlf.exe94⤵PID:772
-
\??\c:\nbbtth.exec:\nbbtth.exe95⤵PID:1084
-
\??\c:\jdjpd.exec:\jdjpd.exe96⤵PID:2196
-
\??\c:\3llxlxl.exec:\3llxlxl.exe97⤵PID:2220
-
\??\c:\thhbbb.exec:\thhbbb.exe98⤵PID:2300
-
\??\c:\ntntnh.exec:\ntntnh.exe99⤵PID:2520
-
\??\c:\pvddj.exec:\pvddj.exe100⤵PID:3068
-
\??\c:\xrfrxxx.exec:\xrfrxxx.exe101⤵PID:2424
-
\??\c:\rxrfrfx.exec:\rxrfrfx.exe102⤵PID:1568
-
\??\c:\tnbnht.exec:\tnbnht.exe103⤵PID:296
-
\??\c:\vdpvd.exec:\vdpvd.exe104⤵PID:920
-
\??\c:\1rfxlxl.exec:\1rfxlxl.exe105⤵PID:1960
-
\??\c:\bhbtnb.exec:\bhbtnb.exe106⤵PID:1492
-
\??\c:\ttnnht.exec:\ttnnht.exe107⤵PID:904
-
\??\c:\7dpjp.exec:\7dpjp.exe108⤵PID:3056
-
\??\c:\rrlrffr.exec:\rrlrffr.exe109⤵PID:2488
-
\??\c:\7hthbn.exec:\7hthbn.exe110⤵PID:1852
-
\??\c:\1pjjv.exec:\1pjjv.exe111⤵PID:1016
-
\??\c:\rxxlxlf.exec:\rxxlxlf.exe112⤵PID:1896
-
\??\c:\rrrxxlr.exec:\rrrxxlr.exe113⤵PID:3060
-
\??\c:\hbntnh.exec:\hbntnh.exe114⤵PID:2512
-
\??\c:\vvpjv.exec:\vvpjv.exe115⤵PID:2996
-
\??\c:\tnthnt.exec:\tnthnt.exe116⤵PID:1652
-
\??\c:\tbhtnh.exec:\tbhtnh.exe117⤵PID:2732
-
\??\c:\vdddv.exec:\vdddv.exe118⤵PID:1548
-
\??\c:\lfxfxrx.exec:\lfxfxrx.exe119⤵PID:2608
-
\??\c:\tnnbnn.exec:\tnnbnn.exe120⤵PID:2712
-
\??\c:\pvpvj.exec:\pvpvj.exe121⤵PID:808
-
\??\c:\rrfrlrl.exec:\rrfrlrl.exe122⤵PID:2404
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-