Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 07:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b29e99ecfeb574f1481cdb7bc98cfacec964bb65da97d55537b4e0d76271efc4N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
b29e99ecfeb574f1481cdb7bc98cfacec964bb65da97d55537b4e0d76271efc4N.exe
-
Size
453KB
-
MD5
d892adb80943af01c5182dc217341a80
-
SHA1
3bcfa54d1af68603fbd2f536406aa4ce33709a50
-
SHA256
b29e99ecfeb574f1481cdb7bc98cfacec964bb65da97d55537b4e0d76271efc4
-
SHA512
ce5fd84959dd18b833ee38e01b93d5d032b023fe8a94aca42e360367b153fd44415208c4d9383287d8c948e1406cafc86e5474a85bc493aedd1d74f1ecf7f5cd
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeW:q7Tc2NYHUrAwfMp3CDW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2700-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/640-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-225-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/984-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1124-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-208-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2116-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-162-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1660-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-514-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1416-899-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/684-921-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-950-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2808 9rlrflr.exe 2668 rfffrlf.exe 2788 nhnbnn.exe 2676 jjpdd.exe 2544 xlxffxx.exe 3012 5bhbbb.exe 640 lxrlflx.exe 1052 xrllrrf.exe 3008 3tnbbn.exe 2384 jdvjv.exe 2124 1fxfrrf.exe 2416 thbbht.exe 1660 9lfxxfr.exe 2256 lfrxlrx.exe 1656 bthbhh.exe 320 vpdvv.exe 2116 xffxxfx.exe 2360 hhbhth.exe 2212 ppppv.exe 1180 xxxfxxf.exe 2120 hnnntn.exe 1328 5dvjd.exe 2488 rfxlxlx.exe 1124 bnnhth.exe 984 1frflrl.exe 996 bnhbbb.exe 2032 ppjvd.exe 1020 nhthtt.exe 900 dvjpd.exe 2700 xlrrlrr.exe 2828 hbnbhn.exe 2540 pdddp.exe 2868 llfrflf.exe 2820 btthtb.exe 2588 vpdpd.exe 2596 fxllrxf.exe 592 rrrrxrl.exe 2372 1tnbnt.exe 2420 jjjvj.exe 2760 ddpdp.exe 1416 9xllrff.exe 2000 7fxfrrx.exe 604 tnbnhh.exe 1792 jdddp.exe 2400 jdpjj.exe 2796 frfxflr.exe 1732 nbnnbt.exe 2520 vvvdj.exe 2620 xlxxffr.exe 1688 jdvdp.exe 320 7fxlxfx.exe 2940 btntbh.exe 2172 jjjvp.exe 2368 7xllrxl.exe 2456 tthntb.exe 2152 pppdv.exe 1736 rrlxlrf.exe 1208 bbtbnt.exe 1536 bbnbnt.exe 1548 pdpjd.exe 2016 fffrflf.exe 1124 ttnbnt.exe 1844 5jddp.exe 940 xlrxlff.exe -
resource yara_rule behavioral1/memory/2700-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-57-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/3012-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/640-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/984-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1124-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-740-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-753-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-869-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-921-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-928-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-950-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrllxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffflxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2700 wrote to memory of 2808 2700 b29e99ecfeb574f1481cdb7bc98cfacec964bb65da97d55537b4e0d76271efc4N.exe 31 PID 2700 wrote to memory of 2808 2700 b29e99ecfeb574f1481cdb7bc98cfacec964bb65da97d55537b4e0d76271efc4N.exe 31 PID 2700 wrote to memory of 2808 2700 b29e99ecfeb574f1481cdb7bc98cfacec964bb65da97d55537b4e0d76271efc4N.exe 31 PID 2700 wrote to memory of 2808 2700 b29e99ecfeb574f1481cdb7bc98cfacec964bb65da97d55537b4e0d76271efc4N.exe 31 PID 2808 wrote to memory of 2668 2808 9rlrflr.exe 32 PID 2808 wrote to memory of 2668 2808 9rlrflr.exe 32 PID 2808 wrote to memory of 2668 2808 9rlrflr.exe 32 PID 2808 wrote to memory of 2668 2808 9rlrflr.exe 32 PID 2668 wrote to memory of 2788 2668 rfffrlf.exe 33 PID 2668 wrote to memory of 2788 2668 rfffrlf.exe 33 PID 2668 wrote to memory of 2788 2668 rfffrlf.exe 33 PID 2668 wrote to memory of 2788 2668 rfffrlf.exe 33 PID 2788 wrote to memory of 2676 2788 nhnbnn.exe 34 PID 2788 wrote to memory of 2676 2788 nhnbnn.exe 34 PID 2788 wrote to memory of 2676 2788 nhnbnn.exe 34 PID 2788 wrote to memory of 2676 2788 nhnbnn.exe 34 PID 2676 wrote to memory of 2544 2676 jjpdd.exe 35 PID 2676 wrote to memory of 2544 2676 jjpdd.exe 35 PID 2676 wrote to memory of 2544 2676 jjpdd.exe 35 PID 2676 wrote to memory of 2544 2676 jjpdd.exe 35 PID 2544 wrote to memory of 3012 2544 xlxffxx.exe 36 PID 2544 wrote to memory of 3012 2544 xlxffxx.exe 36 PID 2544 wrote to memory of 3012 2544 xlxffxx.exe 36 PID 2544 wrote to memory of 3012 2544 xlxffxx.exe 36 PID 3012 wrote to memory of 640 3012 5bhbbb.exe 37 PID 3012 wrote to memory of 640 3012 5bhbbb.exe 37 PID 3012 wrote to memory of 640 3012 5bhbbb.exe 37 PID 3012 wrote to memory of 640 3012 5bhbbb.exe 37 PID 640 wrote to memory of 1052 640 lxrlflx.exe 38 PID 640 wrote to memory of 1052 640 lxrlflx.exe 38 PID 640 wrote to memory of 1052 640 lxrlflx.exe 38 PID 640 wrote to memory of 1052 640 lxrlflx.exe 38 PID 1052 wrote to memory of 3008 1052 xrllrrf.exe 39 PID 1052 wrote to memory of 3008 1052 xrllrrf.exe 39 PID 1052 wrote to memory of 3008 1052 xrllrrf.exe 39 PID 1052 wrote to memory of 3008 1052 xrllrrf.exe 39 PID 3008 wrote to memory of 2384 3008 3tnbbn.exe 40 PID 3008 wrote to memory of 2384 3008 3tnbbn.exe 40 PID 3008 wrote to memory of 2384 3008 3tnbbn.exe 40 PID 3008 wrote to memory of 2384 3008 3tnbbn.exe 40 PID 2384 wrote to memory of 2124 2384 jdvjv.exe 41 PID 2384 wrote to memory of 2124 2384 jdvjv.exe 41 PID 2384 wrote to memory of 2124 2384 jdvjv.exe 41 PID 2384 wrote to memory of 2124 2384 jdvjv.exe 41 PID 2124 wrote to memory of 2416 2124 1fxfrrf.exe 42 PID 2124 wrote to memory of 2416 2124 1fxfrrf.exe 42 PID 2124 wrote to memory of 2416 2124 1fxfrrf.exe 42 PID 2124 wrote to memory of 2416 2124 1fxfrrf.exe 42 PID 2416 wrote to memory of 1660 2416 thbbht.exe 43 PID 2416 wrote to memory of 1660 2416 thbbht.exe 43 PID 2416 wrote to memory of 1660 2416 thbbht.exe 43 PID 2416 wrote to memory of 1660 2416 thbbht.exe 43 PID 1660 wrote to memory of 2256 1660 9lfxxfr.exe 44 PID 1660 wrote to memory of 2256 1660 9lfxxfr.exe 44 PID 1660 wrote to memory of 2256 1660 9lfxxfr.exe 44 PID 1660 wrote to memory of 2256 1660 9lfxxfr.exe 44 PID 2256 wrote to memory of 1656 2256 lfrxlrx.exe 45 PID 2256 wrote to memory of 1656 2256 lfrxlrx.exe 45 PID 2256 wrote to memory of 1656 2256 lfrxlrx.exe 45 PID 2256 wrote to memory of 1656 2256 lfrxlrx.exe 45 PID 1656 wrote to memory of 320 1656 bthbhh.exe 46 PID 1656 wrote to memory of 320 1656 bthbhh.exe 46 PID 1656 wrote to memory of 320 1656 bthbhh.exe 46 PID 1656 wrote to memory of 320 1656 bthbhh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\b29e99ecfeb574f1481cdb7bc98cfacec964bb65da97d55537b4e0d76271efc4N.exe"C:\Users\Admin\AppData\Local\Temp\b29e99ecfeb574f1481cdb7bc98cfacec964bb65da97d55537b4e0d76271efc4N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\9rlrflr.exec:\9rlrflr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\rfffrlf.exec:\rfffrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\nhnbnn.exec:\nhnbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\jjpdd.exec:\jjpdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\xlxffxx.exec:\xlxffxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\5bhbbb.exec:\5bhbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\lxrlflx.exec:\lxrlflx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\xrllrrf.exec:\xrllrrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\3tnbbn.exec:\3tnbbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\jdvjv.exec:\jdvjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\1fxfrrf.exec:\1fxfrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\thbbht.exec:\thbbht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\9lfxxfr.exec:\9lfxxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\lfrxlrx.exec:\lfrxlrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\bthbhh.exec:\bthbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\vpdvv.exec:\vpdvv.exe17⤵
- Executes dropped EXE
PID:320 -
\??\c:\xffxxfx.exec:\xffxxfx.exe18⤵
- Executes dropped EXE
PID:2116 -
\??\c:\hhbhth.exec:\hhbhth.exe19⤵
- Executes dropped EXE
PID:2360 -
\??\c:\ppppv.exec:\ppppv.exe20⤵
- Executes dropped EXE
PID:2212 -
\??\c:\xxxfxxf.exec:\xxxfxxf.exe21⤵
- Executes dropped EXE
PID:1180 -
\??\c:\hnnntn.exec:\hnnntn.exe22⤵
- Executes dropped EXE
PID:2120 -
\??\c:\5dvjd.exec:\5dvjd.exe23⤵
- Executes dropped EXE
PID:1328 -
\??\c:\rfxlxlx.exec:\rfxlxlx.exe24⤵
- Executes dropped EXE
PID:2488 -
\??\c:\bnnhth.exec:\bnnhth.exe25⤵
- Executes dropped EXE
PID:1124 -
\??\c:\1frflrl.exec:\1frflrl.exe26⤵
- Executes dropped EXE
PID:984 -
\??\c:\bnhbbb.exec:\bnhbbb.exe27⤵
- Executes dropped EXE
PID:996 -
\??\c:\ppjvd.exec:\ppjvd.exe28⤵
- Executes dropped EXE
PID:2032 -
\??\c:\nhthtt.exec:\nhthtt.exe29⤵
- Executes dropped EXE
PID:1020 -
\??\c:\dvjpd.exec:\dvjpd.exe30⤵
- Executes dropped EXE
PID:900 -
\??\c:\xlrrlrr.exec:\xlrrlrr.exe31⤵
- Executes dropped EXE
PID:2700 -
\??\c:\hbnbhn.exec:\hbnbhn.exe32⤵
- Executes dropped EXE
PID:2828 -
\??\c:\pdddp.exec:\pdddp.exe33⤵
- Executes dropped EXE
PID:2540 -
\??\c:\llfrflf.exec:\llfrflf.exe34⤵
- Executes dropped EXE
PID:2868 -
\??\c:\btthtb.exec:\btthtb.exe35⤵
- Executes dropped EXE
PID:2820 -
\??\c:\vpdpd.exec:\vpdpd.exe36⤵
- Executes dropped EXE
PID:2588 -
\??\c:\fxllrxf.exec:\fxllrxf.exe37⤵
- Executes dropped EXE
PID:2596 -
\??\c:\rrrrxrl.exec:\rrrrxrl.exe38⤵
- Executes dropped EXE
PID:592 -
\??\c:\1tnbnt.exec:\1tnbnt.exe39⤵
- Executes dropped EXE
PID:2372 -
\??\c:\jjjvj.exec:\jjjvj.exe40⤵
- Executes dropped EXE
PID:2420 -
\??\c:\ddpdp.exec:\ddpdp.exe41⤵
- Executes dropped EXE
PID:2760 -
\??\c:\9xllrff.exec:\9xllrff.exe42⤵
- Executes dropped EXE
PID:1416 -
\??\c:\7fxfrrx.exec:\7fxfrrx.exe43⤵
- Executes dropped EXE
PID:2000 -
\??\c:\tnbnhh.exec:\tnbnhh.exe44⤵
- Executes dropped EXE
PID:604 -
\??\c:\jdddp.exec:\jdddp.exe45⤵
- Executes dropped EXE
PID:1792 -
\??\c:\jdpjj.exec:\jdpjj.exe46⤵
- Executes dropped EXE
PID:2400 -
\??\c:\frfxflr.exec:\frfxflr.exe47⤵
- Executes dropped EXE
PID:2796 -
\??\c:\nbnnbt.exec:\nbnnbt.exe48⤵
- Executes dropped EXE
PID:1732 -
\??\c:\vvvdj.exec:\vvvdj.exe49⤵
- Executes dropped EXE
PID:2520 -
\??\c:\xlxxffr.exec:\xlxxffr.exe50⤵
- Executes dropped EXE
PID:2620 -
\??\c:\jdvdp.exec:\jdvdp.exe51⤵
- Executes dropped EXE
PID:1688 -
\??\c:\7fxlxfx.exec:\7fxlxfx.exe52⤵
- Executes dropped EXE
PID:320 -
\??\c:\btntbh.exec:\btntbh.exe53⤵
- Executes dropped EXE
PID:2940 -
\??\c:\jjjvp.exec:\jjjvp.exe54⤵
- Executes dropped EXE
PID:2172 -
\??\c:\7xllrxl.exec:\7xllrxl.exe55⤵
- Executes dropped EXE
PID:2368 -
\??\c:\tthntb.exec:\tthntb.exe56⤵
- Executes dropped EXE
PID:2456 -
\??\c:\pppdv.exec:\pppdv.exe57⤵
- Executes dropped EXE
PID:2152 -
\??\c:\rrlxlrf.exec:\rrlxlrf.exe58⤵
- Executes dropped EXE
PID:1736 -
\??\c:\bbtbnt.exec:\bbtbnt.exe59⤵
- Executes dropped EXE
PID:1208 -
\??\c:\bbnbnt.exec:\bbnbnt.exe60⤵
- Executes dropped EXE
PID:1536 -
\??\c:\pdpjd.exec:\pdpjd.exe61⤵
- Executes dropped EXE
PID:1548 -
\??\c:\fffrflf.exec:\fffrflf.exe62⤵
- Executes dropped EXE
PID:2016 -
\??\c:\ttnbnt.exec:\ttnbnt.exe63⤵
- Executes dropped EXE
PID:1124 -
\??\c:\5jddp.exec:\5jddp.exe64⤵
- Executes dropped EXE
PID:1844 -
\??\c:\xlrxlff.exec:\xlrxlff.exe65⤵
- Executes dropped EXE
PID:940 -
\??\c:\rlllllr.exec:\rlllllr.exe66⤵PID:1780
-
\??\c:\nbbhth.exec:\nbbhth.exe67⤵PID:1992
-
\??\c:\vvpvj.exec:\vvpvj.exe68⤵PID:2356
-
\??\c:\xlxxflf.exec:\xlxxflf.exe69⤵PID:2736
-
\??\c:\htnntn.exec:\htnntn.exe70⤵PID:1524
-
\??\c:\ppjvp.exec:\ppjvp.exe71⤵PID:1568
-
\??\c:\7pjvp.exec:\7pjvp.exe72⤵PID:1516
-
\??\c:\5frrrxf.exec:\5frrrxf.exe73⤵PID:1480
-
\??\c:\hnnnbn.exec:\hnnnbn.exe74⤵PID:2788
-
\??\c:\pjvjd.exec:\pjvjd.exe75⤵PID:2580
-
\??\c:\xfflxfr.exec:\xfflxfr.exe76⤵PID:2676
-
\??\c:\xrflxfx.exec:\xrflxfx.exe77⤵PID:2716
-
\??\c:\hhtbhn.exec:\hhtbhn.exe78⤵PID:2528
-
\??\c:\1jpvv.exec:\1jpvv.exe79⤵PID:2604
-
\??\c:\3rflrrl.exec:\3rflrrl.exe80⤵PID:2656
-
\??\c:\hnbnbn.exec:\hnbnbn.exe81⤵PID:576
-
\??\c:\hbntbh.exec:\hbntbh.exe82⤵PID:1872
-
\??\c:\ddvpd.exec:\ddvpd.exe83⤵PID:1416
-
\??\c:\xrlrfll.exec:\xrlrfll.exe84⤵PID:2988
-
\??\c:\7nhnbh.exec:\7nhnbh.exe85⤵PID:604
-
\??\c:\jjvdj.exec:\jjvdj.exe86⤵PID:1792
-
\??\c:\jjjpd.exec:\jjjpd.exe87⤵PID:1508
-
\??\c:\ffflrxl.exec:\ffflrxl.exe88⤵PID:1624
-
\??\c:\1tthnb.exec:\1tthnb.exe89⤵PID:2792
-
\??\c:\thttbb.exec:\thttbb.exe90⤵PID:2764
-
\??\c:\vpddp.exec:\vpddp.exe91⤵PID:1860
-
\??\c:\lllxlrf.exec:\lllxlrf.exe92⤵PID:1644
-
\??\c:\flfrflf.exec:\flfrflf.exe93⤵PID:2944
-
\??\c:\nthbnh.exec:\nthbnh.exe94⤵PID:320
-
\??\c:\jjjjp.exec:\jjjjp.exe95⤵PID:2940
-
\??\c:\djddp.exec:\djddp.exe96⤵PID:988
-
\??\c:\rxrrffr.exec:\rxrrffr.exe97⤵PID:2368
-
\??\c:\bhnnhb.exec:\bhnnhb.exe98⤵PID:408
-
\??\c:\ntnbtt.exec:\ntnbtt.exe99⤵PID:2396
-
\??\c:\pjddv.exec:\pjddv.exe100⤵PID:1736
-
\??\c:\5xlxlfl.exec:\5xlxlfl.exe101⤵PID:700
-
\??\c:\nhhthn.exec:\nhhthn.exe102⤵PID:1840
-
\??\c:\ttthtb.exec:\ttthtb.exe103⤵PID:1700
-
\??\c:\pjddj.exec:\pjddj.exe104⤵PID:2476
-
\??\c:\rlrrflx.exec:\rlrrflx.exe105⤵PID:2276
-
\??\c:\hhbbnt.exec:\hhbbnt.exe106⤵PID:268
-
\??\c:\1btthn.exec:\1btthn.exe107⤵PID:2964
-
\??\c:\3jdjp.exec:\3jdjp.exe108⤵PID:2284
-
\??\c:\rrlxxfr.exec:\rrlxxfr.exe109⤵PID:1376
-
\??\c:\1xflxfr.exec:\1xflxfr.exe110⤵PID:792
-
\??\c:\nttntn.exec:\nttntn.exe111⤵PID:1520
-
\??\c:\dvjpd.exec:\dvjpd.exe112⤵PID:2748
-
\??\c:\djjvp.exec:\djjvp.exe113⤵PID:2928
-
\??\c:\xxflflx.exec:\xxflflx.exe114⤵PID:1428
-
\??\c:\thtntb.exec:\thtntb.exe115⤵PID:2640
-
\??\c:\vvpdp.exec:\vvpdp.exe116⤵PID:2704
-
\??\c:\ddjpj.exec:\ddjpj.exe117⤵PID:2268
-
\??\c:\lfrxllf.exec:\lfrxllf.exe118⤵PID:2856
-
\??\c:\7ttbhn.exec:\7ttbhn.exe119⤵PID:2816
-
\??\c:\nhthbh.exec:\nhthbh.exe120⤵PID:2648
-
\??\c:\7jdjp.exec:\7jdjp.exe121⤵PID:3040
-
\??\c:\3pjjp.exec:\3pjjp.exe122⤵PID:1120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-