Analysis
-
max time kernel
120s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 03:46
Static task
static1
Behavioral task
behavioral1
Sample
1d2149e3d2b4370c3111a75a1b45938094877cfe31dc661f35fa92bfd7c27bc9N.exe
Resource
win7-20240903-en
General
-
Target
1d2149e3d2b4370c3111a75a1b45938094877cfe31dc661f35fa92bfd7c27bc9N.exe
-
Size
456KB
-
MD5
96fce5078f6f51a076033a0fb4331190
-
SHA1
91ead86c8a5121dfae8cf390d6884af1840a6aba
-
SHA256
1d2149e3d2b4370c3111a75a1b45938094877cfe31dc661f35fa92bfd7c27bc9
-
SHA512
5b2c91c99840832c605bb5eeac6608d661c5001e7a38042be850c91b33963232cff7cb547ab34f2cca5734b927a149048d1fede2460075b5024bfc51ded7ac58
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRwt:q7Tc2NYHUrAwfMp3CDRwt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
Processes:
resource yara_rule behavioral1/memory/1936-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/796-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-46-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2716-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-75-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2980-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-215-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1040-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-366-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2804-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-472-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2348-492-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2348-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-284-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3000-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/740-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1272-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-162-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2456-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-542-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2300-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/892-552-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1484-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-626-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2916-641-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1996-670-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-802-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-816-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-834-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1516-835-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2112-869-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2344-875-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2560-954-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2808-970-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2004-977-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2944-1002-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2960-1009-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1948-1076-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tnbnbt.exepjvdp.exejpjjp.exehhtbbb.exe1vjpv.exerlxrffl.exentnbtb.exelfrrxlr.exerxrxlrf.exerrlrflx.exedjpjp.exexxrrxxx.exebbnttb.exehbtnbb.exe3jvdd.exerflffll.exehtnbhh.exebtntnt.exelxrrxff.exe9htbbb.exevpddv.exe1pddd.exefxrlllx.exenntnht.exe7ppdd.exe5nnhtn.exe7lxrxrf.exe5bttbh.exe7dvjp.exenhhnbb.exerxxrrxr.exenhttnt.exe7vdvp.exe5xrrfxf.exexlrlfff.exetnnhbn.exejvvdv.exexxrxrlf.exexxxlrxl.exehnnnbn.exevjvjv.exepjjpd.exelfxfffr.exettnbnb.exennhbtb.exeppjdp.exelfrfllx.exebtbntb.exetbthnh.exejddvd.exe1frrxlr.exelfxlrll.exebnbbtt.exejvppd.exepjvpd.exe5xrflll.exebhhbbb.exe7htbnt.exe7vjvd.exe1pvdp.exefxlrllf.exehbthhb.exedvjdp.exe5xrrlfr.exepid Process 796 tnbnbt.exe 2488 pjvdp.exe 2112 jpjjp.exe 2680 hhtbbb.exe 2832 1vjpv.exe 2716 rlxrffl.exe 2688 ntnbtb.exe 2980 lfrrxlr.exe 2568 rxrxlrf.exe 2200 rrlrflx.exe 1996 djpjp.exe 2880 xxrrxxx.exe 2560 bbnttb.exe 2660 hbtnbb.exe 2456 3jvdd.exe 2672 rflffll.exe 1424 htnbhh.exe 2960 btntnt.exe 2380 lxrrxff.exe 2132 9htbbb.exe 2028 vpddv.exe 1500 1pddd.exe 1272 fxrlllx.exe 1600 nntnht.exe 1652 7ppdd.exe 740 5nnhtn.exe 1700 7lxrxrf.exe 1040 5bttbh.exe 3000 7dvjp.exe 1816 nhhnbb.exe 2360 rxxrrxr.exe 1584 nhttnt.exe 2332 7vdvp.exe 2888 5xrrfxf.exe 936 xlrlfff.exe 2828 tnnhbn.exe 2788 jvvdv.exe 2580 xxrxrlf.exe 2796 xxxlrxl.exe 2744 hnnnbn.exe 2608 vjvjv.exe 2980 pjjpd.exe 2620 lfxfffr.exe 1252 ttnbnb.exe 820 nnhbtb.exe 2948 ppjdp.exe 2804 lfrfllx.exe 468 btbntb.exe 1972 tbthnh.exe 1748 jddvd.exe 2876 1frrxlr.exe 2040 lfxlrll.exe 2936 bnbbtt.exe 1944 jvppd.exe 2944 pjvpd.exe 2756 5xrflll.exe 2348 bhhbbb.exe 408 7htbnt.exe 1928 7vjvd.exe 680 1pvdp.exe 1612 fxlrllf.exe 1532 hbthhb.exe 888 dvjdp.exe 316 5xrrlfr.exe -
Processes:
resource yara_rule behavioral1/memory/1936-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/796-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/740-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-206-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2132-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-542-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2300-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-626-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2916-641-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1996-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-788-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2188-802-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-809-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-816-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-834-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2344-849-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-925-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-990-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2944-1002-0x0000000000320000-0x000000000034A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
dvjdj.exejvppd.exexfxllfl.exe1lfrxlx.exelfxlrxr.exepvppd.exe9vddj.exe5vjdp.exepvjjd.exebhhthn.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lfrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhthn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1d2149e3d2b4370c3111a75a1b45938094877cfe31dc661f35fa92bfd7c27bc9N.exetnbnbt.exepjvdp.exejpjjp.exehhtbbb.exe1vjpv.exerlxrffl.exentnbtb.exelfrrxlr.exerxrxlrf.exerrlrflx.exedjpjp.exexxrrxxx.exebbnttb.exehbtnbb.exe3jvdd.exedescription pid Process procid_target PID 1936 wrote to memory of 796 1936 1d2149e3d2b4370c3111a75a1b45938094877cfe31dc661f35fa92bfd7c27bc9N.exe 31 PID 1936 wrote to memory of 796 1936 1d2149e3d2b4370c3111a75a1b45938094877cfe31dc661f35fa92bfd7c27bc9N.exe 31 PID 1936 wrote to memory of 796 1936 1d2149e3d2b4370c3111a75a1b45938094877cfe31dc661f35fa92bfd7c27bc9N.exe 31 PID 1936 wrote to memory of 796 1936 1d2149e3d2b4370c3111a75a1b45938094877cfe31dc661f35fa92bfd7c27bc9N.exe 31 PID 796 wrote to memory of 2488 796 tnbnbt.exe 32 PID 796 wrote to memory of 2488 796 tnbnbt.exe 32 PID 796 wrote to memory of 2488 796 tnbnbt.exe 32 PID 796 wrote to memory of 2488 796 tnbnbt.exe 32 PID 2488 wrote to memory of 2112 2488 pjvdp.exe 33 PID 2488 wrote to memory of 2112 2488 pjvdp.exe 33 PID 2488 wrote to memory of 2112 2488 pjvdp.exe 33 PID 2488 wrote to memory of 2112 2488 pjvdp.exe 33 PID 2112 wrote to memory of 2680 2112 jpjjp.exe 34 PID 2112 wrote to memory of 2680 2112 jpjjp.exe 34 PID 2112 wrote to memory of 2680 2112 jpjjp.exe 34 PID 2112 wrote to memory of 2680 2112 jpjjp.exe 34 PID 2680 wrote to memory of 2832 2680 hhtbbb.exe 35 PID 2680 wrote to memory of 2832 2680 hhtbbb.exe 35 PID 2680 wrote to memory of 2832 2680 hhtbbb.exe 35 PID 2680 wrote to memory of 2832 2680 hhtbbb.exe 35 PID 2832 wrote to memory of 2716 2832 1vjpv.exe 36 PID 2832 wrote to memory of 2716 2832 1vjpv.exe 36 PID 2832 wrote to memory of 2716 2832 1vjpv.exe 36 PID 2832 wrote to memory of 2716 2832 1vjpv.exe 36 PID 2716 wrote to memory of 2688 2716 rlxrffl.exe 37 PID 2716 wrote to memory of 2688 2716 rlxrffl.exe 37 PID 2716 wrote to memory of 2688 2716 rlxrffl.exe 37 PID 2716 wrote to memory of 2688 2716 rlxrffl.exe 37 PID 2688 wrote to memory of 2980 2688 ntnbtb.exe 72 PID 2688 wrote to memory of 2980 2688 ntnbtb.exe 72 PID 2688 wrote to memory of 2980 2688 ntnbtb.exe 72 PID 2688 wrote to memory of 2980 2688 ntnbtb.exe 72 PID 2980 wrote to memory of 2568 2980 lfrrxlr.exe 39 PID 2980 wrote to memory of 2568 2980 lfrrxlr.exe 39 PID 2980 wrote to memory of 2568 2980 lfrrxlr.exe 39 PID 2980 wrote to memory of 2568 2980 lfrrxlr.exe 39 PID 2568 wrote to memory of 2200 2568 rxrxlrf.exe 40 PID 2568 wrote to memory of 2200 2568 rxrxlrf.exe 40 PID 2568 wrote to memory of 2200 2568 rxrxlrf.exe 40 PID 2568 wrote to memory of 2200 2568 rxrxlrf.exe 40 PID 2200 wrote to memory of 1996 2200 rrlrflx.exe 41 PID 2200 wrote to memory of 1996 2200 rrlrflx.exe 41 PID 2200 wrote to memory of 1996 2200 rrlrflx.exe 41 PID 2200 wrote to memory of 1996 2200 rrlrflx.exe 41 PID 1996 wrote to memory of 2880 1996 djpjp.exe 42 PID 1996 wrote to memory of 2880 1996 djpjp.exe 42 PID 1996 wrote to memory of 2880 1996 djpjp.exe 42 PID 1996 wrote to memory of 2880 1996 djpjp.exe 42 PID 2880 wrote to memory of 2560 2880 xxrrxxx.exe 43 PID 2880 wrote to memory of 2560 2880 xxrrxxx.exe 43 PID 2880 wrote to memory of 2560 2880 xxrrxxx.exe 43 PID 2880 wrote to memory of 2560 2880 xxrrxxx.exe 43 PID 2560 wrote to memory of 2660 2560 bbnttb.exe 44 PID 2560 wrote to memory of 2660 2560 bbnttb.exe 44 PID 2560 wrote to memory of 2660 2560 bbnttb.exe 44 PID 2560 wrote to memory of 2660 2560 bbnttb.exe 44 PID 2660 wrote to memory of 2456 2660 hbtnbb.exe 45 PID 2660 wrote to memory of 2456 2660 hbtnbb.exe 45 PID 2660 wrote to memory of 2456 2660 hbtnbb.exe 45 PID 2660 wrote to memory of 2456 2660 hbtnbb.exe 45 PID 2456 wrote to memory of 2672 2456 3jvdd.exe 46 PID 2456 wrote to memory of 2672 2456 3jvdd.exe 46 PID 2456 wrote to memory of 2672 2456 3jvdd.exe 46 PID 2456 wrote to memory of 2672 2456 3jvdd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d2149e3d2b4370c3111a75a1b45938094877cfe31dc661f35fa92bfd7c27bc9N.exe"C:\Users\Admin\AppData\Local\Temp\1d2149e3d2b4370c3111a75a1b45938094877cfe31dc661f35fa92bfd7c27bc9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\tnbnbt.exec:\tnbnbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\pjvdp.exec:\pjvdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\jpjjp.exec:\jpjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\hhtbbb.exec:\hhtbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\1vjpv.exec:\1vjpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\rlxrffl.exec:\rlxrffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\ntnbtb.exec:\ntnbtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\lfrrxlr.exec:\lfrrxlr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\rxrxlrf.exec:\rxrxlrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\rrlrflx.exec:\rrlrflx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\djpjp.exec:\djpjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\xxrrxxx.exec:\xxrrxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\bbnttb.exec:\bbnttb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\hbtnbb.exec:\hbtnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\3jvdd.exec:\3jvdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\rflffll.exec:\rflffll.exe17⤵
- Executes dropped EXE
PID:2672 -
\??\c:\htnbhh.exec:\htnbhh.exe18⤵
- Executes dropped EXE
PID:1424 -
\??\c:\btntnt.exec:\btntnt.exe19⤵
- Executes dropped EXE
PID:2960 -
\??\c:\lxrrxff.exec:\lxrrxff.exe20⤵
- Executes dropped EXE
PID:2380 -
\??\c:\9htbbb.exec:\9htbbb.exe21⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vpddv.exec:\vpddv.exe22⤵
- Executes dropped EXE
PID:2028 -
\??\c:\1pddd.exec:\1pddd.exe23⤵
- Executes dropped EXE
PID:1500 -
\??\c:\fxrlllx.exec:\fxrlllx.exe24⤵
- Executes dropped EXE
PID:1272 -
\??\c:\nntnht.exec:\nntnht.exe25⤵
- Executes dropped EXE
PID:1600 -
\??\c:\7ppdd.exec:\7ppdd.exe26⤵
- Executes dropped EXE
PID:1652 -
\??\c:\5nnhtn.exec:\5nnhtn.exe27⤵
- Executes dropped EXE
PID:740 -
\??\c:\7lxrxrf.exec:\7lxrxrf.exe28⤵
- Executes dropped EXE
PID:1700 -
\??\c:\5bttbh.exec:\5bttbh.exe29⤵
- Executes dropped EXE
PID:1040 -
\??\c:\7dvjp.exec:\7dvjp.exe30⤵
- Executes dropped EXE
PID:3000 -
\??\c:\nhhnbb.exec:\nhhnbb.exe31⤵
- Executes dropped EXE
PID:1816 -
\??\c:\rxxrrxr.exec:\rxxrrxr.exe32⤵
- Executes dropped EXE
PID:2360 -
\??\c:\nhttnt.exec:\nhttnt.exe33⤵
- Executes dropped EXE
PID:1584 -
\??\c:\7vdvp.exec:\7vdvp.exe34⤵
- Executes dropped EXE
PID:2332 -
\??\c:\5xrrfxf.exec:\5xrrfxf.exe35⤵
- Executes dropped EXE
PID:2888 -
\??\c:\xlrlfff.exec:\xlrlfff.exe36⤵
- Executes dropped EXE
PID:936 -
\??\c:\tnnhbn.exec:\tnnhbn.exe37⤵
- Executes dropped EXE
PID:2828 -
\??\c:\jvvdv.exec:\jvvdv.exe38⤵
- Executes dropped EXE
PID:2788 -
\??\c:\xxrxrlf.exec:\xxrxrlf.exe39⤵
- Executes dropped EXE
PID:2580 -
\??\c:\xxxlrxl.exec:\xxxlrxl.exe40⤵
- Executes dropped EXE
PID:2796 -
\??\c:\hnnnbn.exec:\hnnnbn.exe41⤵
- Executes dropped EXE
PID:2744 -
\??\c:\vjvjv.exec:\vjvjv.exe42⤵
- Executes dropped EXE
PID:2608 -
\??\c:\pjjpd.exec:\pjjpd.exe43⤵
- Executes dropped EXE
PID:2980 -
\??\c:\lfxfffr.exec:\lfxfffr.exe44⤵
- Executes dropped EXE
PID:2620 -
\??\c:\ttnbnb.exec:\ttnbnb.exe45⤵
- Executes dropped EXE
PID:1252 -
\??\c:\nnhbtb.exec:\nnhbtb.exe46⤵
- Executes dropped EXE
PID:820 -
\??\c:\ppjdp.exec:\ppjdp.exe47⤵
- Executes dropped EXE
PID:2948 -
\??\c:\lfrfllx.exec:\lfrfllx.exe48⤵
- Executes dropped EXE
PID:2804 -
\??\c:\btbntb.exec:\btbntb.exe49⤵
- Executes dropped EXE
PID:468 -
\??\c:\tbthnh.exec:\tbthnh.exe50⤵
- Executes dropped EXE
PID:1972 -
\??\c:\jddvd.exec:\jddvd.exe51⤵
- Executes dropped EXE
PID:1748 -
\??\c:\1frrxlr.exec:\1frrxlr.exe52⤵
- Executes dropped EXE
PID:2876 -
\??\c:\lfxlrll.exec:\lfxlrll.exe53⤵
- Executes dropped EXE
PID:2040 -
\??\c:\bnbbtt.exec:\bnbbtt.exe54⤵
- Executes dropped EXE
PID:2936 -
\??\c:\jvppd.exec:\jvppd.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1944 -
\??\c:\pjvpd.exec:\pjvpd.exe56⤵
- Executes dropped EXE
PID:2944 -
\??\c:\5xrflll.exec:\5xrflll.exe57⤵
- Executes dropped EXE
PID:2756 -
\??\c:\bhhbbb.exec:\bhhbbb.exe58⤵
- Executes dropped EXE
PID:2348 -
\??\c:\7htbnt.exec:\7htbnt.exe59⤵
- Executes dropped EXE
PID:408 -
\??\c:\7vjvd.exec:\7vjvd.exe60⤵
- Executes dropped EXE
PID:1928 -
\??\c:\1pvdp.exec:\1pvdp.exe61⤵
- Executes dropped EXE
PID:680 -
\??\c:\fxlrllf.exec:\fxlrllf.exe62⤵
- Executes dropped EXE
PID:1612 -
\??\c:\hbthhb.exec:\hbthhb.exe63⤵
- Executes dropped EXE
PID:1532 -
\??\c:\dvjdp.exec:\dvjdp.exe64⤵
- Executes dropped EXE
PID:888 -
\??\c:\5xrrlfr.exec:\5xrrlfr.exe65⤵
- Executes dropped EXE
PID:316 -
\??\c:\hbbnbt.exec:\hbbnbt.exe66⤵PID:1100
-
\??\c:\dvvvp.exec:\dvvvp.exe67⤵PID:1088
-
\??\c:\rlxxllr.exec:\rlxxllr.exe68⤵PID:1700
-
\??\c:\ttttht.exec:\ttttht.exe69⤵PID:2300
-
\??\c:\pvpvp.exec:\pvpvp.exe70⤵PID:892
-
\??\c:\xrxfrfl.exec:\xrxfrfl.exe71⤵PID:1516
-
\??\c:\xrffllr.exec:\xrffllr.exe72⤵PID:2336
-
\??\c:\jpjjv.exec:\jpjjv.exe73⤵PID:2360
-
\??\c:\lfxrxxr.exec:\lfxrxxr.exe74⤵PID:2324
-
\??\c:\9bhhhh.exec:\9bhhhh.exe75⤵PID:764
-
\??\c:\ffrlfxx.exec:\ffrlfxx.exe76⤵PID:1484
-
\??\c:\btnttb.exec:\btnttb.exe77⤵PID:2328
-
\??\c:\ppppd.exec:\ppppd.exe78⤵PID:3016
-
\??\c:\llfxflf.exec:\llfxflf.exe79⤵PID:2832
-
\??\c:\tntbnn.exec:\tntbnn.exe80⤵PID:2840
-
\??\c:\vpjpd.exec:\vpjpd.exe81⤵PID:2120
-
\??\c:\btnbnh.exec:\btnbnh.exe82⤵PID:1712
-
\??\c:\vpjjd.exec:\vpjjd.exe83⤵PID:2688
-
\??\c:\llxxxfr.exec:\llxxxfr.exe84⤵PID:1932
-
\??\c:\tththn.exec:\tththn.exe85⤵PID:2916
-
\??\c:\jvjjp.exec:\jvjjp.exe86⤵PID:2584
-
\??\c:\dddpd.exec:\dddpd.exe87⤵PID:2648
-
\??\c:\xlllfll.exec:\xlllfll.exe88⤵PID:1512
-
\??\c:\bhnbhn.exec:\bhnbhn.exe89⤵PID:1996
-
\??\c:\jdjpj.exec:\jdjpj.exe90⤵PID:2880
-
\??\c:\vpvvv.exec:\vpvvv.exe91⤵PID:548
-
\??\c:\5xfllrf.exec:\5xfllrf.exe92⤵PID:1852
-
\??\c:\bnbbhh.exec:\bnbbhh.exe93⤵PID:2092
-
\??\c:\jppdj.exec:\jppdj.exe94⤵PID:2868
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe95⤵PID:1988
-
\??\c:\nhthtb.exec:\nhthtb.exe96⤵PID:2316
-
\??\c:\5hthtb.exec:\5hthtb.exe97⤵PID:1564
-
\??\c:\vjvjp.exec:\vjvjp.exe98⤵PID:2088
-
\??\c:\lfxfxfl.exec:\lfxfxfl.exe99⤵PID:2536
-
\??\c:\xrlxlxl.exec:\xrlxlxl.exe100⤵PID:916
-
\??\c:\bbbhtb.exec:\bbbhtb.exe101⤵PID:1332
-
\??\c:\vvpjd.exec:\vvpjd.exe102⤵PID:692
-
\??\c:\xrlfffl.exec:\xrlfffl.exe103⤵PID:1500
-
\??\c:\3ttbtb.exec:\3ttbtb.exe104⤵PID:3060
-
\??\c:\vjvjj.exec:\vjvjj.exe105⤵PID:1636
-
\??\c:\ffffrxl.exec:\ffffrxl.exe106⤵PID:1104
-
\??\c:\bbbtbt.exec:\bbbtbt.exe107⤵PID:1724
-
\??\c:\dpdpp.exec:\dpdpp.exe108⤵PID:2388
-
\??\c:\flxfxxl.exec:\flxfxxl.exe109⤵PID:776
-
\??\c:\5thntt.exec:\5thntt.exe110⤵PID:2188
-
\??\c:\vpjvd.exec:\vpjvd.exe111⤵PID:1568
-
\??\c:\xrxfllr.exec:\xrxfllr.exe112⤵PID:1040
-
\??\c:\xrflxxx.exec:\xrflxxx.exe113⤵PID:2064
-
\??\c:\hhtthh.exec:\hhtthh.exe114⤵PID:2268
-
\??\c:\pjdvp.exec:\pjdvp.exe115⤵PID:1516
-
\??\c:\jdvdj.exec:\jdvdj.exe116⤵PID:2336
-
\??\c:\9lffllr.exec:\9lffllr.exe117⤵PID:2492
-
\??\c:\nhttbb.exec:\nhttbb.exe118⤵PID:2344
-
\??\c:\pdjpp.exec:\pdjpp.exe119⤵PID:2280
-
\??\c:\jdjpp.exec:\jdjpp.exe120⤵PID:2112
-
\??\c:\xxlrfff.exec:\xxlrfff.exe121⤵PID:2768
-
\??\c:\tnbntt.exec:\tnbntt.exe122⤵PID:2704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-