Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 01:37
Behavioral task
behavioral1
Sample
9bb3127dfaac24bdb2913e631a1feb901aa64890a3bc1ec05eabdb0abaa02d59.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
9bb3127dfaac24bdb2913e631a1feb901aa64890a3bc1ec05eabdb0abaa02d59.exe
-
Size
97KB
-
MD5
014301727aebf8c5af2524178d99c7e2
-
SHA1
2b5ea27c9308c551c3491968bd2bee6d2f314d7e
-
SHA256
9bb3127dfaac24bdb2913e631a1feb901aa64890a3bc1ec05eabdb0abaa02d59
-
SHA512
3b17f8446b02e70b96452a10a56f869891e111607aa94bf3a2c1b7ce73d266481d8e04cd72ab9d0929c221df9dc830d7099752d06e19beb83fc84068523c4b4f
-
SSDEEP
3072:8hOmTsF93UYfwC6GIout0fmCiiiXA6mzgr:8cm4FmowdHoSgWrXUgr
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral1/memory/2348-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1980-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2332-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/848-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-55-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2684-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2788-71-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2788-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-105-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2128-113-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1528-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1148-162-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1148-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1784-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2216-191-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2324-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1728-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1564-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3020-256-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1272-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-270-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1656-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1656-272-0x00000000776C0000-0x00000000777DF000-memory.dmp family_blackmoon behavioral1/memory/1980-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2996-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2996-301-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1944-305-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/1944-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/536-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/772-320-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/536-316-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2684-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-340-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2596-351-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2560-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-407-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2948-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-434-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2208-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2096-456-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/712-499-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/3016-522-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2076-553-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1944-565-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-607-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2644-631-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2140-684-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1608-693-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2452-738-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1496-778-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1596-781-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/772-825-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2804-834-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2768-837-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1656-20306-0x00000000776C0000-0x00000000777DF000-memory.dmp family_blackmoon behavioral1/memory/1656-24482-0x00000000776C0000-0x00000000777DF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7bhbnt.exehnnhtt.exeffrflxl.exexxrrflr.exehthttn.exevvppp.exelxrfxfx.exelxffllf.exehnhhnh.exejjdjv.exexllfrrx.exetttntb.exevpdjv.exedvpjv.exe3xrrxff.exenbtthh.exebntbhh.exevpjdp.exexfrfxrl.exehbhhtt.exenbnhhn.exejdvpd.exepjjpd.exerlxflxl.exethbhtn.exe3dvdd.exe7pjjj.exehbtbtt.exe3httbt.exevpdvj.exexxlffxf.exebhbbnb.exe1nhhhh.exejvddd.exelfrxrrx.exebtntbh.exepjvdd.exe7vpvv.exe5jjpd.exerfxxlrr.exenthnbb.exehthhnh.exeddpvd.exe5fxrffr.exe5hhhnh.exenhbbhb.exejjdjv.exepppjd.exefxxffff.exehbthth.exe1thtbb.exedjpjv.exexxxflrx.exe7llxxxf.exehtbbbb.exehbnnhb.exedpddj.exeflxfffr.exetnnnhn.exehnhbtn.exepjvvd.exe1djpp.exefxrflfr.exenhbbbh.exepid Process 1980 7bhbnt.exe 2008 hnnhtt.exe 2332 ffrflxl.exe 848 xxrrflr.exe 2160 hthttn.exe 2864 vvppp.exe 2684 lxrfxfx.exe 2788 lxffllf.exe 2700 hnhhnh.exe 2860 jjdjv.exe 2744 xllfrrx.exe 2588 tttntb.exe 2128 vpdjv.exe 1528 dvpjv.exe 2664 3xrrxff.exe 2836 nbtthh.exe 2908 bntbhh.exe 496 vpjdp.exe 1148 xfrfxrl.exe 1784 hbhhtt.exe 2124 nbnhhn.exe 1976 jdvpd.exe 2216 pjjpd.exe 2280 rlxflxl.exe 2324 thbhtn.exe 2540 3dvdd.exe 1728 7pjjj.exe 1364 hbtbtt.exe 1564 3httbt.exe 2224 vpdvj.exe 3020 xxlffxf.exe 1272 bhbbnb.exe 2536 1nhhhh.exe 1656 jvddd.exe 3056 lfrxrrx.exe 2288 btntbh.exe 2360 pjvdd.exe 2996 7vpvv.exe 1944 5jjpd.exe 536 rfxxlrr.exe 772 nthnbb.exe 2720 hthhnh.exe 2684 ddpvd.exe 2704 5fxrffr.exe 2732 5hhhnh.exe 2596 nhbbhb.exe 2844 jjdjv.exe 2604 pppjd.exe 2572 fxxffff.exe 2624 hbthth.exe 2128 1thtbb.exe 2004 djpjv.exe 2560 xxxflrx.exe 2920 7llxxxf.exe 2836 htbbbb.exe 2912 hbnnhb.exe 2928 dpddj.exe 1144 flxfffr.exe 1908 tnnnhn.exe 2948 hnhbtn.exe 2972 pjvvd.exe 2964 1djpp.exe 2208 fxrflfr.exe 2672 nhbbbh.exe -
Processes:
resource yara_rule behavioral1/memory/2348-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2348-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120ff-5.dat upx behavioral1/files/0x0008000000016652-16.dat upx behavioral1/memory/2008-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1980-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016858-23.dat upx behavioral1/memory/2332-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016b17-31.dat upx behavioral1/files/0x0007000000016c76-38.dat upx behavioral1/memory/848-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2160-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2864-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c81-47.dat upx behavioral1/files/0x0007000000016c89-56.dat upx behavioral1/memory/2684-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000017546-63.dat upx behavioral1/memory/2788-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193a2-72.dat upx behavioral1/files/0x00050000000193af-81.dat upx behavioral1/memory/2700-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2860-88-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2860-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193c9-90.dat upx behavioral1/files/0x00050000000193f8-98.dat upx behavioral1/memory/2588-105-0x00000000003A0000-0x00000000003C7000-memory.dmp upx behavioral1/files/0x00050000000193fa-106.dat upx behavioral1/files/0x0005000000019494-115.dat upx behavioral1/memory/1528-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194a7-122.dat upx behavioral1/memory/2664-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194b4-130.dat upx behavioral1/files/0x00050000000194d4-139.dat upx behavioral1/memory/2836-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2908-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194da-147.dat upx behavioral1/files/0x00050000000194e2-155.dat upx behavioral1/memory/1148-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ea-163.dat upx behavioral1/files/0x00050000000194f2-172.dat upx behavioral1/memory/1784-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194f6-179.dat upx behavioral1/files/0x0005000000019501-186.dat upx behavioral1/files/0x0005000000019503-194.dat upx behavioral1/files/0x0005000000019515-202.dat upx behavioral1/memory/2324-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001953a-211.dat upx behavioral1/files/0x000500000001957c-218.dat upx behavioral1/memory/1728-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019589-226.dat upx behavioral1/files/0x000500000001961b-233.dat upx behavioral1/files/0x0009000000016311-241.dat upx behavioral1/memory/1564-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961f-249.dat upx behavioral1/memory/1272-260-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019624-258.dat upx behavioral1/memory/1656-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1656-272-0x00000000776C0000-0x00000000777DF000-memory.dmp upx behavioral1/memory/1980-280-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2996-302-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1944-305-0x00000000005C0000-0x00000000005E7000-memory.dmp upx behavioral1/memory/1944-309-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/536-317-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2684-334-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
lrrffxr.exennbtnn.exevppjd.exe7xrxrrx.exe5flllfl.exe9jvjp.exedpdpd.exenhnnnh.exehbthth.exevpjpd.exedpdjv.exepdjpj.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5flllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9bb3127dfaac24bdb2913e631a1feb901aa64890a3bc1ec05eabdb0abaa02d59.exe7bhbnt.exehnnhtt.exeffrflxl.exexxrrflr.exehthttn.exevvppp.exelxrfxfx.exelxffllf.exehnhhnh.exejjdjv.exexllfrrx.exetttntb.exevpdjv.exedvpjv.exe3xrrxff.exedescription pid Process procid_target PID 2348 wrote to memory of 1980 2348 9bb3127dfaac24bdb2913e631a1feb901aa64890a3bc1ec05eabdb0abaa02d59.exe 30 PID 2348 wrote to memory of 1980 2348 9bb3127dfaac24bdb2913e631a1feb901aa64890a3bc1ec05eabdb0abaa02d59.exe 30 PID 2348 wrote to memory of 1980 2348 9bb3127dfaac24bdb2913e631a1feb901aa64890a3bc1ec05eabdb0abaa02d59.exe 30 PID 2348 wrote to memory of 1980 2348 9bb3127dfaac24bdb2913e631a1feb901aa64890a3bc1ec05eabdb0abaa02d59.exe 30 PID 1980 wrote to memory of 2008 1980 7bhbnt.exe 31 PID 1980 wrote to memory of 2008 1980 7bhbnt.exe 31 PID 1980 wrote to memory of 2008 1980 7bhbnt.exe 31 PID 1980 wrote to memory of 2008 1980 7bhbnt.exe 31 PID 2008 wrote to memory of 2332 2008 hnnhtt.exe 32 PID 2008 wrote to memory of 2332 2008 hnnhtt.exe 32 PID 2008 wrote to memory of 2332 2008 hnnhtt.exe 32 PID 2008 wrote to memory of 2332 2008 hnnhtt.exe 32 PID 2332 wrote to memory of 848 2332 ffrflxl.exe 33 PID 2332 wrote to memory of 848 2332 ffrflxl.exe 33 PID 2332 wrote to memory of 848 2332 ffrflxl.exe 33 PID 2332 wrote to memory of 848 2332 ffrflxl.exe 33 PID 848 wrote to memory of 2160 848 xxrrflr.exe 34 PID 848 wrote to memory of 2160 848 xxrrflr.exe 34 PID 848 wrote to memory of 2160 848 xxrrflr.exe 34 PID 848 wrote to memory of 2160 848 xxrrflr.exe 34 PID 2160 wrote to memory of 2864 2160 hthttn.exe 35 PID 2160 wrote to memory of 2864 2160 hthttn.exe 35 PID 2160 wrote to memory of 2864 2160 hthttn.exe 35 PID 2160 wrote to memory of 2864 2160 hthttn.exe 35 PID 2864 wrote to memory of 2684 2864 vvppp.exe 36 PID 2864 wrote to memory of 2684 2864 vvppp.exe 36 PID 2864 wrote to memory of 2684 2864 vvppp.exe 36 PID 2864 wrote to memory of 2684 2864 vvppp.exe 36 PID 2684 wrote to memory of 2788 2684 lxrfxfx.exe 37 PID 2684 wrote to memory of 2788 2684 lxrfxfx.exe 37 PID 2684 wrote to memory of 2788 2684 lxrfxfx.exe 37 PID 2684 wrote to memory of 2788 2684 lxrfxfx.exe 37 PID 2788 wrote to memory of 2700 2788 lxffllf.exe 38 PID 2788 wrote to memory of 2700 2788 lxffllf.exe 38 PID 2788 wrote to memory of 2700 2788 lxffllf.exe 38 PID 2788 wrote to memory of 2700 2788 lxffllf.exe 38 PID 2700 wrote to memory of 2860 2700 hnhhnh.exe 40 PID 2700 wrote to memory of 2860 2700 hnhhnh.exe 40 PID 2700 wrote to memory of 2860 2700 hnhhnh.exe 40 PID 2700 wrote to memory of 2860 2700 hnhhnh.exe 40 PID 2860 wrote to memory of 2744 2860 jjdjv.exe 41 PID 2860 wrote to memory of 2744 2860 jjdjv.exe 41 PID 2860 wrote to memory of 2744 2860 jjdjv.exe 41 PID 2860 wrote to memory of 2744 2860 jjdjv.exe 41 PID 2744 wrote to memory of 2588 2744 xllfrrx.exe 42 PID 2744 wrote to memory of 2588 2744 xllfrrx.exe 42 PID 2744 wrote to memory of 2588 2744 xllfrrx.exe 42 PID 2744 wrote to memory of 2588 2744 xllfrrx.exe 42 PID 2588 wrote to memory of 2128 2588 tttntb.exe 43 PID 2588 wrote to memory of 2128 2588 tttntb.exe 43 PID 2588 wrote to memory of 2128 2588 tttntb.exe 43 PID 2588 wrote to memory of 2128 2588 tttntb.exe 43 PID 2128 wrote to memory of 1528 2128 vpdjv.exe 44 PID 2128 wrote to memory of 1528 2128 vpdjv.exe 44 PID 2128 wrote to memory of 1528 2128 vpdjv.exe 44 PID 2128 wrote to memory of 1528 2128 vpdjv.exe 44 PID 1528 wrote to memory of 2664 1528 dvpjv.exe 45 PID 1528 wrote to memory of 2664 1528 dvpjv.exe 45 PID 1528 wrote to memory of 2664 1528 dvpjv.exe 45 PID 1528 wrote to memory of 2664 1528 dvpjv.exe 45 PID 2664 wrote to memory of 2836 2664 3xrrxff.exe 46 PID 2664 wrote to memory of 2836 2664 3xrrxff.exe 46 PID 2664 wrote to memory of 2836 2664 3xrrxff.exe 46 PID 2664 wrote to memory of 2836 2664 3xrrxff.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\9bb3127dfaac24bdb2913e631a1feb901aa64890a3bc1ec05eabdb0abaa02d59.exe"C:\Users\Admin\AppData\Local\Temp\9bb3127dfaac24bdb2913e631a1feb901aa64890a3bc1ec05eabdb0abaa02d59.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\7bhbnt.exec:\7bhbnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\hnnhtt.exec:\hnnhtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\ffrflxl.exec:\ffrflxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\xxrrflr.exec:\xxrrflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\hthttn.exec:\hthttn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\vvppp.exec:\vvppp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\lxrfxfx.exec:\lxrfxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\lxffllf.exec:\lxffllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\hnhhnh.exec:\hnhhnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\jjdjv.exec:\jjdjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\xllfrrx.exec:\xllfrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\tttntb.exec:\tttntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\vpdjv.exec:\vpdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\dvpjv.exec:\dvpjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\3xrrxff.exec:\3xrrxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\nbtthh.exec:\nbtthh.exe17⤵
- Executes dropped EXE
PID:2836 -
\??\c:\bntbhh.exec:\bntbhh.exe18⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vpjdp.exec:\vpjdp.exe19⤵
- Executes dropped EXE
PID:496 -
\??\c:\xfrfxrl.exec:\xfrfxrl.exe20⤵
- Executes dropped EXE
PID:1148 -
\??\c:\hbhhtt.exec:\hbhhtt.exe21⤵
- Executes dropped EXE
PID:1784 -
\??\c:\nbnhhn.exec:\nbnhhn.exe22⤵
- Executes dropped EXE
PID:2124 -
\??\c:\jdvpd.exec:\jdvpd.exe23⤵
- Executes dropped EXE
PID:1976 -
\??\c:\pjjpd.exec:\pjjpd.exe24⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rlxflxl.exec:\rlxflxl.exe25⤵
- Executes dropped EXE
PID:2280 -
\??\c:\thbhtn.exec:\thbhtn.exe26⤵
- Executes dropped EXE
PID:2324 -
\??\c:\3dvdd.exec:\3dvdd.exe27⤵
- Executes dropped EXE
PID:2540 -
\??\c:\7pjjj.exec:\7pjjj.exe28⤵
- Executes dropped EXE
PID:1728 -
\??\c:\hbtbtt.exec:\hbtbtt.exe29⤵
- Executes dropped EXE
PID:1364 -
\??\c:\3httbt.exec:\3httbt.exe30⤵
- Executes dropped EXE
PID:1564 -
\??\c:\vpdvj.exec:\vpdvj.exe31⤵
- Executes dropped EXE
PID:2224 -
\??\c:\xxlffxf.exec:\xxlffxf.exe32⤵
- Executes dropped EXE
PID:3020 -
\??\c:\bhbbnb.exec:\bhbbnb.exe33⤵
- Executes dropped EXE
PID:1272 -
\??\c:\1nhhhh.exec:\1nhhhh.exe34⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jvddd.exec:\jvddd.exe35⤵
- Executes dropped EXE
PID:1656 -
\??\c:\dvdvv.exec:\dvdvv.exe36⤵PID:1980
-
\??\c:\lfrxrrx.exec:\lfrxrrx.exe37⤵
- Executes dropped EXE
PID:3056 -
\??\c:\btntbh.exec:\btntbh.exe38⤵
- Executes dropped EXE
PID:2288 -
\??\c:\pjvdd.exec:\pjvdd.exe39⤵
- Executes dropped EXE
PID:2360 -
\??\c:\7vpvv.exec:\7vpvv.exe40⤵
- Executes dropped EXE
PID:2996 -
\??\c:\5jjpd.exec:\5jjpd.exe41⤵
- Executes dropped EXE
PID:1944 -
\??\c:\rfxxlrr.exec:\rfxxlrr.exe42⤵
- Executes dropped EXE
PID:536 -
\??\c:\nthnbb.exec:\nthnbb.exe43⤵
- Executes dropped EXE
PID:772 -
\??\c:\hthhnh.exec:\hthhnh.exe44⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ddpvd.exec:\ddpvd.exe45⤵
- Executes dropped EXE
PID:2684 -
\??\c:\5fxrffr.exec:\5fxrffr.exe46⤵
- Executes dropped EXE
PID:2704 -
\??\c:\5hhhnh.exec:\5hhhnh.exe47⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nhbbhb.exec:\nhbbhb.exe48⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jjdjv.exec:\jjdjv.exe49⤵
- Executes dropped EXE
PID:2844 -
\??\c:\pppjd.exec:\pppjd.exe50⤵
- Executes dropped EXE
PID:2604 -
\??\c:\fxxffff.exec:\fxxffff.exe51⤵
- Executes dropped EXE
PID:2572 -
\??\c:\hbthth.exec:\hbthth.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2624 -
\??\c:\1thtbb.exec:\1thtbb.exe53⤵
- Executes dropped EXE
PID:2128 -
\??\c:\djpjv.exec:\djpjv.exe54⤵
- Executes dropped EXE
PID:2004 -
\??\c:\xxxflrx.exec:\xxxflrx.exe55⤵
- Executes dropped EXE
PID:2560 -
\??\c:\7llxxxf.exec:\7llxxxf.exe56⤵
- Executes dropped EXE
PID:2920 -
\??\c:\htbbbb.exec:\htbbbb.exe57⤵
- Executes dropped EXE
PID:2836 -
\??\c:\hbnnhb.exec:\hbnnhb.exe58⤵
- Executes dropped EXE
PID:2912 -
\??\c:\dpddj.exec:\dpddj.exe59⤵
- Executes dropped EXE
PID:2928 -
\??\c:\flxfffr.exec:\flxfffr.exe60⤵
- Executes dropped EXE
PID:1144 -
\??\c:\tnnnhn.exec:\tnnnhn.exe61⤵
- Executes dropped EXE
PID:1908 -
\??\c:\hnhbtn.exec:\hnhbtn.exe62⤵
- Executes dropped EXE
PID:2948 -
\??\c:\pjvvd.exec:\pjvvd.exe63⤵
- Executes dropped EXE
PID:2972 -
\??\c:\1djpp.exec:\1djpp.exe64⤵
- Executes dropped EXE
PID:2964 -
\??\c:\fxrflfr.exec:\fxrflfr.exe65⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nhbbbh.exec:\nhbbbh.exe66⤵
- Executes dropped EXE
PID:2672 -
\??\c:\bthtbh.exec:\bthtbh.exe67⤵PID:2096
-
\??\c:\dppjd.exec:\dppjd.exe68⤵PID:1076
-
\??\c:\dddvv.exec:\dddvv.exe69⤵PID:1688
-
\??\c:\ffxxfff.exec:\ffxxfff.exe70⤵PID:2108
-
\??\c:\xrlxlrx.exec:\xrlxlrx.exe71⤵PID:1956
-
\??\c:\tntbhb.exec:\tntbhb.exe72⤵PID:1760
-
\??\c:\hntnnh.exec:\hntnnh.exe73⤵PID:1364
-
\??\c:\pdjpj.exec:\pdjpj.exe74⤵
- System Location Discovery: System Language Discovery
PID:712 -
\??\c:\3fxfxrx.exec:\3fxfxrx.exe75⤵PID:560
-
\??\c:\rfrlfxf.exec:\rfrlfxf.exe76⤵PID:2992
-
\??\c:\1xrxffl.exec:\1xrxffl.exe77⤵PID:1800
-
\??\c:\bnbhtn.exec:\bnbhtn.exe78⤵PID:3016
-
\??\c:\5hnbbt.exec:\5hnbbt.exe79⤵PID:2536
-
\??\c:\jjvdj.exec:\jjvdj.exe80⤵PID:1604
-
\??\c:\jjdpp.exec:\jjdpp.exe81⤵PID:1980
-
\??\c:\frxfffr.exec:\frxfffr.exe82⤵PID:2104
-
\??\c:\lfxxlrl.exec:\lfxxlrl.exe83⤵PID:2288
-
\??\c:\thtbhn.exec:\thtbhn.exe84⤵PID:2076
-
\??\c:\hthhbn.exec:\hthhbn.exe85⤵PID:2188
-
\??\c:\jdpdj.exec:\jdpdj.exe86⤵PID:1944
-
\??\c:\dvvdj.exec:\dvvdj.exe87⤵PID:2148
-
\??\c:\7ffrxfl.exec:\7ffrxfl.exe88⤵PID:2160
-
\??\c:\lrrflxl.exec:\lrrflxl.exe89⤵PID:2780
-
\??\c:\ntntbb.exec:\ntntbb.exe90⤵PID:1660
-
\??\c:\nnhbnb.exec:\nnhbnb.exe91⤵PID:2812
-
\??\c:\pjppv.exec:\pjppv.exe92⤵PID:2840
-
\??\c:\pjdjp.exec:\pjdjp.exe93⤵PID:2764
-
\??\c:\rrrrxxf.exec:\rrrrxxf.exe94⤵PID:2852
-
\??\c:\xrfrlfl.exec:\xrfrlfl.exe95⤵PID:2620
-
\??\c:\rllrxlr.exec:\rllrxlr.exe96⤵PID:2568
-
\??\c:\3nhntb.exec:\3nhntb.exe97⤵PID:2120
-
\??\c:\nbnthh.exec:\nbnthh.exe98⤵PID:2276
-
\??\c:\9ppvj.exec:\9ppvj.exe99⤵PID:2644
-
\??\c:\vpjvd.exec:\vpjvd.exe100⤵PID:1140
-
\??\c:\rrxlfll.exec:\rrxlfll.exe101⤵PID:2664
-
\??\c:\bbtbnt.exec:\bbtbnt.exe102⤵PID:2820
-
\??\c:\nhtbht.exec:\nhtbht.exe103⤵PID:2892
-
\??\c:\bthttb.exec:\bthttb.exe104⤵PID:2908
-
\??\c:\jddjp.exec:\jddjp.exe105⤵PID:1948
-
\??\c:\9rlrxfr.exec:\9rlrxfr.exe106⤵PID:2380
-
\??\c:\flfrlrx.exec:\flfrlrx.exe107⤵PID:1148
-
\??\c:\btbhnn.exec:\btbhnn.exe108⤵PID:1908
-
\??\c:\3hhtnt.exec:\3hhtnt.exe109⤵PID:2140
-
\??\c:\vvjjv.exec:\vvjjv.exe110⤵PID:1608
-
\??\c:\jvjjv.exec:\jvjjv.exe111⤵PID:2100
-
\??\c:\jjvdj.exec:\jjvdj.exe112⤵PID:2216
-
\??\c:\lxlflfl.exec:\lxlflfl.exe113⤵PID:2184
-
\??\c:\fxllrxl.exec:\fxllrxl.exe114⤵PID:1468
-
\??\c:\hbtthn.exec:\hbtthn.exe115⤵PID:404
-
\??\c:\vpdjj.exec:\vpdjj.exe116⤵PID:1332
-
\??\c:\5jdjj.exec:\5jdjj.exe117⤵PID:676
-
\??\c:\9xxlflx.exec:\9xxlflx.exe118⤵PID:1956
-
\??\c:\llxfxfx.exec:\llxfxfx.exe119⤵PID:2452
-
\??\c:\htbtbt.exec:\htbtbt.exe120⤵PID:2372
-
\??\c:\ttbthn.exec:\ttbthn.exe121⤵PID:1564
-
\??\c:\3dvjd.exec:\3dvjd.exe122⤵PID:2312
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-