Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 03:51
Behavioral task
behavioral1
Sample
414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe
-
Size
88KB
-
MD5
b335a746c82b1ce3728cab35dc3b1e64
-
SHA1
a8091ef3d90b56035109605127d618063f88afdf
-
SHA256
414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d
-
SHA512
357c1783a91ebc7cafe5188dafa5888f4bbc9c7c406c30484aee71e046acfd3ab2a7e651c2276b33c14cd6bcb8f8f731be6b1a6321287af6e930ffb1b153855b
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8yaVskCzYBbKd+XsWgADf1tE7hW1AI:9hOmTsF93UYfwC6GIoutyaVszyKd+XYE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 56 IoCs
resource yara_rule behavioral1/memory/2688-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2184-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/304-74-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/304-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1808-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/348-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/908-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1052-127-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2784-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1260-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/772-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2380-192-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/984-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/596-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/900-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1492-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-297-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2848-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-304-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2320-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-318-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2572-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2788-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/688-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/976-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/408-487-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/780-489-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/344-539-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/764-538-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-633-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-634-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/304-650-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2564-655-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2924-662-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1772-717-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2408-780-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/592-957-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1456-971-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1456-970-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2172-984-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1048-1003-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/840-1017-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/684-1028-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2252-1044-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1996-1058-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/764-1082-0x00000000002F0000-0x0000000000317000-memory.dmp family_blackmoon behavioral1/memory/2512-1286-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2184 nhnntt.exe 2972 9jvvj.exe 2116 vvdjd.exe 3060 llxxlrl.exe 2724 5rrlxfl.exe 2576 pjddj.exe 304 lffllxf.exe 1808 hhnnbn.exe 348 7hbhtt.exe 2144 jdddp.exe 908 xxflfxx.exe 1272 1htbbh.exe 1052 bhhnbh.exe 2784 jpjpd.exe 2800 lfrrxxl.exe 1260 rrlxffl.exe 772 nbnnht.exe 2240 dvjjv.exe 2180 rrrxffr.exe 2380 bbnbhn.exe 956 nhhntt.exe 1820 7pjdp.exe 2512 fxrxflx.exe 984 rlrfrlx.exe 596 bbnnbn.exe 1528 tthhhn.exe 3016 jdppv.exe 900 9rxffll.exe 1492 hnthbt.exe 1028 5nbbhn.exe 1964 9pppj.exe 2848 dvvvv.exe 2832 rllrxrf.exe 2320 xrflxxf.exe 2584 tnbnbb.exe 2920 ttnntt.exe 2840 1dpvp.exe 2572 3lfrrxr.exe 2604 lfxxllx.exe 3048 hbnbtb.exe 2564 tnbbhn.exe 2628 pjjpd.exe 2164 dpdjp.exe 3064 5rrxllx.exe 2788 xrxxffl.exe 1792 tththn.exe 688 5hhntb.exe 2060 vjddj.exe 2908 fxllfrf.exe 976 xrffrlx.exe 2944 nhtbnn.exe 2752 bbhhnt.exe 2940 jdpvp.exe 1316 3pjpv.exe 1772 fxrlxfr.exe 2124 xrffllf.exe 2404 hnbnbh.exe 1968 btnnbb.exe 2136 9vdvj.exe 2080 vvjjd.exe 408 1lfrlfr.exe 780 5xxlrxr.exe 916 xxrlrxl.exe 2408 nhnnnt.exe -
resource yara_rule behavioral1/memory/2688-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000012102-5.dat upx behavioral1/memory/2688-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2972-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000173b2-29.dat upx behavioral1/memory/2116-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000f000000017390-19.dat upx behavioral1/memory/2184-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000173ee-39.dat upx behavioral1/memory/3060-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2116-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000173f6-47.dat upx behavioral1/memory/3060-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2724-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001746c-56.dat upx behavioral1/memory/2724-55-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0007000000017474-66.dat upx behavioral1/memory/2576-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a00000001749c-78.dat upx behavioral1/memory/1808-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/304-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1808-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019238-85.dat upx behavioral1/memory/348-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019614-93.dat upx behavioral1/files/0x0005000000019616-102.dat upx behavioral1/files/0x0005000000019618-110.dat upx behavioral1/memory/908-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1272-119-0x00000000002C0000-0x00000000002E7000-memory.dmp upx behavioral1/files/0x000500000001962a-120.dat upx behavioral1/files/0x000500000001966c-130.dat upx behavioral1/memory/2800-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000196ac-138.dat upx behavioral1/memory/2784-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000196e8-147.dat upx behavioral1/memory/1260-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001997c-157.dat upx behavioral1/memory/1260-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c36-166.dat upx behavioral1/memory/772-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c38-175.dat upx behavioral1/memory/2180-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c3a-184.dat upx behavioral1/files/0x0005000000019c53-195.dat upx behavioral1/files/0x0005000000019d20-202.dat upx behavioral1/files/0x0005000000019d44-211.dat upx behavioral1/memory/2512-219-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019da4-221.dat upx behavioral1/files/0x0005000000019db8-229.dat upx behavioral1/memory/984-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/596-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019f9f-238.dat upx behavioral1/files/0x0005000000019fb9-246.dat upx behavioral1/files/0x000500000001a067-255.dat upx behavioral1/files/0x000500000001a07b-263.dat upx behavioral1/memory/900-262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a0a1-272.dat upx behavioral1/memory/1492-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a301-280.dat upx behavioral1/files/0x000500000001a345-288.dat upx behavioral1/memory/2848-296-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2320-311-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2572-338-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2788-384-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2184 2688 414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe 31 PID 2688 wrote to memory of 2184 2688 414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe 31 PID 2688 wrote to memory of 2184 2688 414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe 31 PID 2688 wrote to memory of 2184 2688 414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe 31 PID 2184 wrote to memory of 2972 2184 nhnntt.exe 32 PID 2184 wrote to memory of 2972 2184 nhnntt.exe 32 PID 2184 wrote to memory of 2972 2184 nhnntt.exe 32 PID 2184 wrote to memory of 2972 2184 nhnntt.exe 32 PID 2972 wrote to memory of 2116 2972 9jvvj.exe 33 PID 2972 wrote to memory of 2116 2972 9jvvj.exe 33 PID 2972 wrote to memory of 2116 2972 9jvvj.exe 33 PID 2972 wrote to memory of 2116 2972 9jvvj.exe 33 PID 2116 wrote to memory of 3060 2116 vvdjd.exe 34 PID 2116 wrote to memory of 3060 2116 vvdjd.exe 34 PID 2116 wrote to memory of 3060 2116 vvdjd.exe 34 PID 2116 wrote to memory of 3060 2116 vvdjd.exe 34 PID 3060 wrote to memory of 2724 3060 llxxlrl.exe 35 PID 3060 wrote to memory of 2724 3060 llxxlrl.exe 35 PID 3060 wrote to memory of 2724 3060 llxxlrl.exe 35 PID 3060 wrote to memory of 2724 3060 llxxlrl.exe 35 PID 2724 wrote to memory of 2576 2724 5rrlxfl.exe 36 PID 2724 wrote to memory of 2576 2724 5rrlxfl.exe 36 PID 2724 wrote to memory of 2576 2724 5rrlxfl.exe 36 PID 2724 wrote to memory of 2576 2724 5rrlxfl.exe 36 PID 2576 wrote to memory of 304 2576 pjddj.exe 37 PID 2576 wrote to memory of 304 2576 pjddj.exe 37 PID 2576 wrote to memory of 304 2576 pjddj.exe 37 PID 2576 wrote to memory of 304 2576 pjddj.exe 37 PID 304 wrote to memory of 1808 304 lffllxf.exe 38 PID 304 wrote to memory of 1808 304 lffllxf.exe 38 PID 304 wrote to memory of 1808 304 lffllxf.exe 38 PID 304 wrote to memory of 1808 304 lffllxf.exe 38 PID 1808 wrote to memory of 348 1808 hhnnbn.exe 39 PID 1808 wrote to memory of 348 1808 hhnnbn.exe 39 PID 1808 wrote to memory of 348 1808 hhnnbn.exe 39 PID 1808 wrote to memory of 348 1808 hhnnbn.exe 39 PID 348 wrote to memory of 2144 348 7hbhtt.exe 40 PID 348 wrote to memory of 2144 348 7hbhtt.exe 40 PID 348 wrote to memory of 2144 348 7hbhtt.exe 40 PID 348 wrote to memory of 2144 348 7hbhtt.exe 40 PID 2144 wrote to memory of 908 2144 jdddp.exe 41 PID 2144 wrote to memory of 908 2144 jdddp.exe 41 PID 2144 wrote to memory of 908 2144 jdddp.exe 41 PID 2144 wrote to memory of 908 2144 jdddp.exe 41 PID 908 wrote to memory of 1272 908 xxflfxx.exe 42 PID 908 wrote to memory of 1272 908 xxflfxx.exe 42 PID 908 wrote to memory of 1272 908 xxflfxx.exe 42 PID 908 wrote to memory of 1272 908 xxflfxx.exe 42 PID 1272 wrote to memory of 1052 1272 1htbbh.exe 43 PID 1272 wrote to memory of 1052 1272 1htbbh.exe 43 PID 1272 wrote to memory of 1052 1272 1htbbh.exe 43 PID 1272 wrote to memory of 1052 1272 1htbbh.exe 43 PID 1052 wrote to memory of 2784 1052 bhhnbh.exe 44 PID 1052 wrote to memory of 2784 1052 bhhnbh.exe 44 PID 1052 wrote to memory of 2784 1052 bhhnbh.exe 44 PID 1052 wrote to memory of 2784 1052 bhhnbh.exe 44 PID 2784 wrote to memory of 2800 2784 jpjpd.exe 45 PID 2784 wrote to memory of 2800 2784 jpjpd.exe 45 PID 2784 wrote to memory of 2800 2784 jpjpd.exe 45 PID 2784 wrote to memory of 2800 2784 jpjpd.exe 45 PID 2800 wrote to memory of 1260 2800 lfrrxxl.exe 46 PID 2800 wrote to memory of 1260 2800 lfrrxxl.exe 46 PID 2800 wrote to memory of 1260 2800 lfrrxxl.exe 46 PID 2800 wrote to memory of 1260 2800 lfrrxxl.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe"C:\Users\Admin\AppData\Local\Temp\414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\nhnntt.exec:\nhnntt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\9jvvj.exec:\9jvvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\vvdjd.exec:\vvdjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\llxxlrl.exec:\llxxlrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\5rrlxfl.exec:\5rrlxfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\pjddj.exec:\pjddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\lffllxf.exec:\lffllxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:304 -
\??\c:\hhnnbn.exec:\hhnnbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\7hbhtt.exec:\7hbhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\jdddp.exec:\jdddp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\xxflfxx.exec:\xxflfxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\1htbbh.exec:\1htbbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\bhhnbh.exec:\bhhnbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\jpjpd.exec:\jpjpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\rrlxffl.exec:\rrlxffl.exe17⤵
- Executes dropped EXE
PID:1260 -
\??\c:\nbnnht.exec:\nbnnht.exe18⤵
- Executes dropped EXE
PID:772 -
\??\c:\dvjjv.exec:\dvjjv.exe19⤵
- Executes dropped EXE
PID:2240 -
\??\c:\rrrxffr.exec:\rrrxffr.exe20⤵
- Executes dropped EXE
PID:2180 -
\??\c:\bbnbhn.exec:\bbnbhn.exe21⤵
- Executes dropped EXE
PID:2380 -
\??\c:\nhhntt.exec:\nhhntt.exe22⤵
- Executes dropped EXE
PID:956 -
\??\c:\7pjdp.exec:\7pjdp.exe23⤵
- Executes dropped EXE
PID:1820 -
\??\c:\fxrxflx.exec:\fxrxflx.exe24⤵
- Executes dropped EXE
PID:2512 -
\??\c:\rlrfrlx.exec:\rlrfrlx.exe25⤵
- Executes dropped EXE
PID:984 -
\??\c:\bbnnbn.exec:\bbnnbn.exe26⤵
- Executes dropped EXE
PID:596 -
\??\c:\tthhhn.exec:\tthhhn.exe27⤵
- Executes dropped EXE
PID:1528 -
\??\c:\jdppv.exec:\jdppv.exe28⤵
- Executes dropped EXE
PID:3016 -
\??\c:\9rxffll.exec:\9rxffll.exe29⤵
- Executes dropped EXE
PID:900 -
\??\c:\hnthbt.exec:\hnthbt.exe30⤵
- Executes dropped EXE
PID:1492 -
\??\c:\5nbbhn.exec:\5nbbhn.exe31⤵
- Executes dropped EXE
PID:1028 -
\??\c:\9pppj.exec:\9pppj.exe32⤵
- Executes dropped EXE
PID:1964 -
\??\c:\dvvvv.exec:\dvvvv.exe33⤵
- Executes dropped EXE
PID:2848 -
\??\c:\rllrxrf.exec:\rllrxrf.exe34⤵
- Executes dropped EXE
PID:2832 -
\??\c:\xrflxxf.exec:\xrflxxf.exe35⤵
- Executes dropped EXE
PID:2320 -
\??\c:\tnbnbb.exec:\tnbnbb.exe36⤵
- Executes dropped EXE
PID:2584 -
\??\c:\ttnntt.exec:\ttnntt.exe37⤵
- Executes dropped EXE
PID:2920 -
\??\c:\1dpvp.exec:\1dpvp.exe38⤵
- Executes dropped EXE
PID:2840 -
\??\c:\3lfrrxr.exec:\3lfrrxr.exe39⤵
- Executes dropped EXE
PID:2572 -
\??\c:\lfxxllx.exec:\lfxxllx.exe40⤵
- Executes dropped EXE
PID:2604 -
\??\c:\hbnbtb.exec:\hbnbtb.exe41⤵
- Executes dropped EXE
PID:3048 -
\??\c:\tnbbhn.exec:\tnbbhn.exe42⤵
- Executes dropped EXE
PID:2564 -
\??\c:\pjjpd.exec:\pjjpd.exe43⤵
- Executes dropped EXE
PID:2628 -
\??\c:\dpdjp.exec:\dpdjp.exe44⤵
- Executes dropped EXE
PID:2164 -
\??\c:\5rrxllx.exec:\5rrxllx.exe45⤵
- Executes dropped EXE
PID:3064 -
\??\c:\xrxxffl.exec:\xrxxffl.exe46⤵
- Executes dropped EXE
PID:2788 -
\??\c:\tththn.exec:\tththn.exe47⤵
- Executes dropped EXE
PID:1792 -
\??\c:\5hhntb.exec:\5hhntb.exe48⤵
- Executes dropped EXE
PID:688 -
\??\c:\vjddj.exec:\vjddj.exe49⤵
- Executes dropped EXE
PID:2060 -
\??\c:\fxllfrf.exec:\fxllfrf.exe50⤵
- Executes dropped EXE
PID:2908 -
\??\c:\xrffrlx.exec:\xrffrlx.exe51⤵
- Executes dropped EXE
PID:976 -
\??\c:\nhtbnn.exec:\nhtbnn.exe52⤵
- Executes dropped EXE
PID:2944 -
\??\c:\bbhhnt.exec:\bbhhnt.exe53⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jdpvp.exec:\jdpvp.exe54⤵
- Executes dropped EXE
PID:2940 -
\??\c:\3pjpv.exec:\3pjpv.exe55⤵
- Executes dropped EXE
PID:1316 -
\??\c:\fxrlxfr.exec:\fxrlxfr.exe56⤵
- Executes dropped EXE
PID:1772 -
\??\c:\xrffllf.exec:\xrffllf.exe57⤵
- Executes dropped EXE
PID:2124 -
\??\c:\hnbnbh.exec:\hnbnbh.exe58⤵
- Executes dropped EXE
PID:2404 -
\??\c:\btnnbb.exec:\btnnbb.exe59⤵
- Executes dropped EXE
PID:1968 -
\??\c:\9vdvj.exec:\9vdvj.exe60⤵
- Executes dropped EXE
PID:2136 -
\??\c:\vvjjd.exec:\vvjjd.exe61⤵
- Executes dropped EXE
PID:2080 -
\??\c:\1lfrlfr.exec:\1lfrlfr.exe62⤵
- Executes dropped EXE
PID:408 -
\??\c:\5xxlrxr.exec:\5xxlrxr.exe63⤵
- Executes dropped EXE
PID:780 -
\??\c:\xxrlrxl.exec:\xxrlrxl.exe64⤵
- Executes dropped EXE
PID:916 -
\??\c:\nhnnnt.exec:\nhnnnt.exe65⤵
- Executes dropped EXE
PID:2408 -
\??\c:\tntbht.exec:\tntbht.exe66⤵PID:2120
-
\??\c:\ddpvj.exec:\ddpvj.exe67⤵PID:3024
-
\??\c:\ffxfrrf.exec:\ffxfrrf.exe68⤵PID:576
-
\??\c:\thtbhh.exec:\thtbhh.exe69⤵PID:2488
-
\??\c:\bnhhhh.exec:\bnhhhh.exe70⤵PID:764
-
\??\c:\7vjdj.exec:\7vjdj.exe71⤵PID:344
-
\??\c:\pjddd.exec:\pjddd.exe72⤵PID:1324
-
\??\c:\fxflrxl.exec:\fxflrxl.exe73⤵PID:2400
-
\??\c:\llfrrfx.exec:\llfrrfx.exe74⤵PID:3036
-
\??\c:\hbnthn.exec:\hbnthn.exe75⤵PID:2720
-
\??\c:\ttbhbn.exec:\ttbhbn.exe76⤵PID:2832
-
\??\c:\vppvp.exec:\vppvp.exe77⤵PID:2116
-
\??\c:\9vpdv.exec:\9vpdv.exe78⤵PID:2588
-
\??\c:\lrrlxxl.exec:\lrrlxxl.exe79⤵PID:2412
-
\??\c:\tthbtn.exec:\tthbtn.exe80⤵PID:2816
-
\??\c:\htnnbh.exec:\htnnbh.exe81⤵PID:2560
-
\??\c:\jddpp.exec:\jddpp.exe82⤵PID:2632
-
\??\c:\jdvjv.exec:\jdvjv.exe83⤵PID:2680
-
\??\c:\fxllllr.exec:\fxllllr.exe84⤵PID:304
-
\??\c:\llffrxl.exec:\llffrxl.exe85⤵PID:2564
-
\??\c:\xflxlfl.exec:\xflxlfl.exe86⤵PID:2308
-
\??\c:\bthhnt.exec:\bthhnt.exe87⤵PID:348
-
\??\c:\vpppv.exec:\vpppv.exe88⤵PID:2804
-
\??\c:\vvvvj.exec:\vvvvj.exe89⤵PID:2924
-
\??\c:\fxrxllr.exec:\fxrxllr.exe90⤵PID:1272
-
\??\c:\rfrxffl.exec:\rfrxffl.exe91⤵PID:1308
-
\??\c:\5bthhn.exec:\5bthhn.exe92⤵PID:2792
-
\??\c:\nnhntt.exec:\nnhntt.exe93⤵PID:2756
-
\??\c:\hbtnbb.exec:\hbtnbb.exe94⤵PID:2364
-
\??\c:\jvvvd.exec:\jvvvd.exe95⤵PID:2104
-
\??\c:\pdjjv.exec:\pdjjv.exe96⤵PID:2016
-
\??\c:\9rrflrf.exec:\9rrflrf.exe97⤵PID:2976
-
\??\c:\xrfxrrf.exec:\xrfxrrf.exe98⤵PID:588
-
\??\c:\tnbhbn.exec:\tnbhbn.exe99⤵PID:1772
-
\??\c:\htnnbb.exec:\htnnbb.exe100⤵PID:2180
-
\??\c:\pjdpv.exec:\pjdpv.exe101⤵
- System Location Discovery: System Language Discovery
PID:2404 -
\??\c:\7vjpv.exec:\7vjpv.exe102⤵PID:2220
-
\??\c:\frlllrl.exec:\frlllrl.exe103⤵PID:1796
-
\??\c:\3lrlrlr.exec:\3lrlrlr.exe104⤵PID:1096
-
\??\c:\hbtnbb.exec:\hbtnbb.exe105⤵PID:1648
-
\??\c:\thtttb.exec:\thtttb.exe106⤵PID:984
-
\??\c:\vppjv.exec:\vppjv.exe107⤵PID:916
-
\??\c:\jjvdv.exec:\jjvdv.exe108⤵PID:2408
-
\??\c:\jdpvd.exec:\jdpvd.exe109⤵PID:1504
-
\??\c:\rlllrrx.exec:\rlllrrx.exe110⤵PID:2336
-
\??\c:\lfrfllr.exec:\lfrfllr.exe111⤵PID:576
-
\??\c:\7bthnt.exec:\7bthnt.exe112⤵PID:2244
-
\??\c:\nhnnbb.exec:\nhnnbb.exe113⤵PID:764
-
\??\c:\dpdpd.exec:\dpdpd.exe114⤵PID:1332
-
\??\c:\pdvdp.exec:\pdvdp.exe115⤵PID:1028
-
\??\c:\pjdjp.exec:\pjdjp.exe116⤵PID:2640
-
\??\c:\llffrrf.exec:\llffrrf.exe117⤵PID:2676
-
\??\c:\5xxfffl.exec:\5xxfffl.exe118⤵PID:2972
-
\??\c:\bnbhtt.exec:\bnbhtt.exe119⤵PID:2152
-
\??\c:\nhbttb.exec:\nhbttb.exe120⤵PID:2320
-
\??\c:\tnbnnn.exec:\tnbnnn.exe121⤵PID:1604
-
\??\c:\3vjvj.exec:\3vjvj.exe122⤵PID:2880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-