Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 11:14
Behavioral task
behavioral1
Sample
94c5d09e7063dba9084ce23232694c9454c520f39092cde8f6d03f45232343a2.exe
Resource
win7-20240903-en
General
-
Target
94c5d09e7063dba9084ce23232694c9454c520f39092cde8f6d03f45232343a2.exe
-
Size
332KB
-
MD5
327d873702a29e016b3efb1d652ef7f1
-
SHA1
d492d233471bd1a83a19d3f32d0fe1f4ef610514
-
SHA256
94c5d09e7063dba9084ce23232694c9454c520f39092cde8f6d03f45232343a2
-
SHA512
9ee0b24f1beb135d5a9022e711adb0f993ace447a4a3edfc0b861b884940b5145dacf73c055e7c1248d6392c967961bc9bfb9711c4faf66c1954139096c5121c
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbe2:R4wFHoSHYHUrAwfMp3CD2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
Processes:
resource yara_rule behavioral1/memory/2472-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1808-25-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1808-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2072-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-75-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2640-74-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2712-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/624-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1740-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1316-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1776-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1776-242-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2080-287-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1612-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1200-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1060-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1060-361-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2808-376-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2808-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1408-445-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1792-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1484-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-488-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1816-531-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2144-543-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/280-11490-0x00000000770D0000-0x00000000771CA000-memory.dmp family_blackmoon behavioral1/memory/280-13076-0x0000000076FB0000-0x00000000770CF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nhnthn.exefrlrxfr.exehhbtnh.exeppvjd.exexlffllf.exehbthth.exedvddj.exexrffrrl.exevppvd.exe9vppv.exehbnntt.exehbnbhn.exelfrxrlr.exelrrlxxl.exejjjjv.exepvvvd.exelrflfll.exebhbnbb.exefxlfffr.exe9xrfxfx.exepppjv.exefxfxrff.exettnnth.exe7rfxffl.exexlrrrrx.exeddppd.exe5lfxrxf.exehtbbbt.exedppjj.exexxffxxr.exe3htbhh.exevpjdj.exe7nhnbh.exetnnnnn.exepdjjj.exerfxfflx.exe5frflrx.exehhbnnt.exepppdv.exe3xllfxf.exerlxllrr.exebntntn.exevpdjp.exepppvd.exexlxlrrf.exebnbnbt.exebbbnht.exejjdpj.exe7xxlrxf.exerllxrlr.exebbnnnn.exejdvjj.exelxfrfrl.exelllxxxr.exehhbhnb.exepppdp.exepjvvd.exexrxfrrr.exehbbhnh.exebthbhh.exeddvdv.exellfrxxl.exelllrrxf.exennhbtn.exepid process 2064 nhnthn.exe 1808 frlrxfr.exe 2072 hhbtnh.exe 2640 ppvjd.exe 2952 xlffllf.exe 2152 hbthth.exe 2764 dvddj.exe 2712 xrffrrl.exe 2856 vppvd.exe 2588 9vppv.exe 2796 hbnntt.exe 2624 hbnbhn.exe 2800 lfrxrlr.exe 2028 lrrlxxl.exe 760 jjjjv.exe 2032 pvvvd.exe 624 lrflfll.exe 2460 bhbnbb.exe 1740 fxlfffr.exe 296 9xrfxfx.exe 2748 pppjv.exe 2548 fxfxrff.exe 2908 ttnnth.exe 2900 7rfxffl.exe 1316 xlrrrrx.exe 344 ddppd.exe 468 5lfxrxf.exe 1776 htbbbt.exe 1648 dppjj.exe 600 xxffxxr.exe 2224 3htbhh.exe 2988 vpjdj.exe 876 7nhnbh.exe 2080 tnnnnn.exe 1612 pdjjj.exe 2108 rfxfflx.exe 1200 5frflrx.exe 2480 hhbnnt.exe 2124 pppdv.exe 3016 3xllfxf.exe 2752 rlxllrr.exe 1244 bntntn.exe 1660 vpdjp.exe 2760 pppvd.exe 2792 xlxlrrf.exe 1060 bnbnbt.exe 2600 bbbnht.exe 2808 jjdpj.exe 2796 7xxlrxf.exe 2572 rllxrlr.exe 2236 bbnnnn.exe 1392 jdvjj.exe 2044 lxfrfrl.exe 1248 lllxxxr.exe 1956 hhbhnb.exe 1692 pppdp.exe 624 pjvvd.exe 1056 xrxfrrr.exe 1940 hbbhnh.exe 1408 bthbhh.exe 1792 ddvdv.exe 2844 llfrxxl.exe 2824 lllrrxf.exe 2932 nnhbtn.exe -
Processes:
resource yara_rule behavioral1/memory/2472-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhnthn.exe upx behavioral1/memory/2064-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2472-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1808-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2064-17-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frlrxfr.exe upx C:\hhbtnh.exe upx behavioral1/memory/1808-27-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppvjd.exe upx behavioral1/memory/2072-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2640-42-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlffllf.exe upx behavioral1/memory/2952-51-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbthth.exe upx C:\dvddj.exe upx C:\xrffrrl.exe upx behavioral1/memory/2764-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vppvd.exe upx behavioral1/memory/2712-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2588-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2856-86-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9vppv.exe upx behavioral1/memory/2588-96-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbnntt.exe upx behavioral1/memory/2796-104-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbnbhn.exe upx C:\lfrxrlr.exe upx behavioral1/memory/2800-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2800-122-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\lrrlxxl.exe upx C:\jjjjv.exe upx C:\pvvvd.exe upx C:\lrflfll.exe upx C:\bhbnbb.exe upx behavioral1/memory/624-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2460-161-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\fxlfffr.exe upx behavioral1/memory/1740-169-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9xrfxfx.exe upx C:\pppjv.exe upx behavioral1/memory/2748-185-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxfxrff.exe upx C:\ttnnth.exe upx behavioral1/memory/2548-195-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7rfxffl.exe upx \??\c:\xlrrrrx.exe upx behavioral1/memory/1316-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-212-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddppd.exe upx behavioral1/memory/344-224-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\5lfxrxf.exe upx C:\htbbbt.exe upx C:\dppjj.exe upx behavioral1/memory/1776-244-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxffxxr.exe upx C:\3htbhh.exe upx C:\vpjdj.exe upx behavioral1/memory/1612-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1200-305-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2480-311-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3016-323-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2760-341-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2760-349-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ppjjj.exevdvvj.exe7frxxxf.exebbhbth.exevvvvp.exefxrxrfx.exetnnhbb.exelllfxfl.exehhnhnt.exedvpdj.exerfxfflx.exepvjvd.exe1fxfxxf.exelfxfffr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxfflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
94c5d09e7063dba9084ce23232694c9454c520f39092cde8f6d03f45232343a2.exenhnthn.exefrlrxfr.exehhbtnh.exeppvjd.exexlffllf.exehbthth.exedvddj.exexrffrrl.exevppvd.exe9vppv.exehbnntt.exehbnbhn.exelfrxrlr.exelrrlxxl.exejjjjv.exedescription pid process target process PID 2472 wrote to memory of 2064 2472 94c5d09e7063dba9084ce23232694c9454c520f39092cde8f6d03f45232343a2.exe nhnthn.exe PID 2472 wrote to memory of 2064 2472 94c5d09e7063dba9084ce23232694c9454c520f39092cde8f6d03f45232343a2.exe nhnthn.exe PID 2472 wrote to memory of 2064 2472 94c5d09e7063dba9084ce23232694c9454c520f39092cde8f6d03f45232343a2.exe nhnthn.exe PID 2472 wrote to memory of 2064 2472 94c5d09e7063dba9084ce23232694c9454c520f39092cde8f6d03f45232343a2.exe nhnthn.exe PID 2064 wrote to memory of 1808 2064 nhnthn.exe frlrxfr.exe PID 2064 wrote to memory of 1808 2064 nhnthn.exe frlrxfr.exe PID 2064 wrote to memory of 1808 2064 nhnthn.exe frlrxfr.exe PID 2064 wrote to memory of 1808 2064 nhnthn.exe frlrxfr.exe PID 1808 wrote to memory of 2072 1808 frlrxfr.exe hhbtnh.exe PID 1808 wrote to memory of 2072 1808 frlrxfr.exe hhbtnh.exe PID 1808 wrote to memory of 2072 1808 frlrxfr.exe hhbtnh.exe PID 1808 wrote to memory of 2072 1808 frlrxfr.exe hhbtnh.exe PID 2072 wrote to memory of 2640 2072 hhbtnh.exe ppvjd.exe PID 2072 wrote to memory of 2640 2072 hhbtnh.exe ppvjd.exe PID 2072 wrote to memory of 2640 2072 hhbtnh.exe ppvjd.exe PID 2072 wrote to memory of 2640 2072 hhbtnh.exe ppvjd.exe PID 2640 wrote to memory of 2952 2640 ppvjd.exe xlffllf.exe PID 2640 wrote to memory of 2952 2640 ppvjd.exe xlffllf.exe PID 2640 wrote to memory of 2952 2640 ppvjd.exe xlffllf.exe PID 2640 wrote to memory of 2952 2640 ppvjd.exe xlffllf.exe PID 2952 wrote to memory of 2152 2952 xlffllf.exe hbthth.exe PID 2952 wrote to memory of 2152 2952 xlffllf.exe hbthth.exe PID 2952 wrote to memory of 2152 2952 xlffllf.exe hbthth.exe PID 2952 wrote to memory of 2152 2952 xlffllf.exe hbthth.exe PID 2152 wrote to memory of 2764 2152 hbthth.exe dvddj.exe PID 2152 wrote to memory of 2764 2152 hbthth.exe dvddj.exe PID 2152 wrote to memory of 2764 2152 hbthth.exe dvddj.exe PID 2152 wrote to memory of 2764 2152 hbthth.exe dvddj.exe PID 2764 wrote to memory of 2712 2764 dvddj.exe xrffrrl.exe PID 2764 wrote to memory of 2712 2764 dvddj.exe xrffrrl.exe PID 2764 wrote to memory of 2712 2764 dvddj.exe xrffrrl.exe PID 2764 wrote to memory of 2712 2764 dvddj.exe xrffrrl.exe PID 2712 wrote to memory of 2856 2712 xrffrrl.exe vppvd.exe PID 2712 wrote to memory of 2856 2712 xrffrrl.exe vppvd.exe PID 2712 wrote to memory of 2856 2712 xrffrrl.exe vppvd.exe PID 2712 wrote to memory of 2856 2712 xrffrrl.exe vppvd.exe PID 2856 wrote to memory of 2588 2856 vppvd.exe 9vppv.exe PID 2856 wrote to memory of 2588 2856 vppvd.exe 9vppv.exe PID 2856 wrote to memory of 2588 2856 vppvd.exe 9vppv.exe PID 2856 wrote to memory of 2588 2856 vppvd.exe 9vppv.exe PID 2588 wrote to memory of 2796 2588 9vppv.exe hbnntt.exe PID 2588 wrote to memory of 2796 2588 9vppv.exe hbnntt.exe PID 2588 wrote to memory of 2796 2588 9vppv.exe hbnntt.exe PID 2588 wrote to memory of 2796 2588 9vppv.exe hbnntt.exe PID 2796 wrote to memory of 2624 2796 hbnntt.exe hbnbhn.exe PID 2796 wrote to memory of 2624 2796 hbnntt.exe hbnbhn.exe PID 2796 wrote to memory of 2624 2796 hbnntt.exe hbnbhn.exe PID 2796 wrote to memory of 2624 2796 hbnntt.exe hbnbhn.exe PID 2624 wrote to memory of 2800 2624 hbnbhn.exe lfrxrlr.exe PID 2624 wrote to memory of 2800 2624 hbnbhn.exe lfrxrlr.exe PID 2624 wrote to memory of 2800 2624 hbnbhn.exe lfrxrlr.exe PID 2624 wrote to memory of 2800 2624 hbnbhn.exe lfrxrlr.exe PID 2800 wrote to memory of 2028 2800 lfrxrlr.exe lrrlxxl.exe PID 2800 wrote to memory of 2028 2800 lfrxrlr.exe lrrlxxl.exe PID 2800 wrote to memory of 2028 2800 lfrxrlr.exe lrrlxxl.exe PID 2800 wrote to memory of 2028 2800 lfrxrlr.exe lrrlxxl.exe PID 2028 wrote to memory of 760 2028 lrrlxxl.exe jjjjv.exe PID 2028 wrote to memory of 760 2028 lrrlxxl.exe jjjjv.exe PID 2028 wrote to memory of 760 2028 lrrlxxl.exe jjjjv.exe PID 2028 wrote to memory of 760 2028 lrrlxxl.exe jjjjv.exe PID 760 wrote to memory of 2032 760 jjjjv.exe pvvvd.exe PID 760 wrote to memory of 2032 760 jjjjv.exe pvvvd.exe PID 760 wrote to memory of 2032 760 jjjjv.exe pvvvd.exe PID 760 wrote to memory of 2032 760 jjjjv.exe pvvvd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\94c5d09e7063dba9084ce23232694c9454c520f39092cde8f6d03f45232343a2.exe"C:\Users\Admin\AppData\Local\Temp\94c5d09e7063dba9084ce23232694c9454c520f39092cde8f6d03f45232343a2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\nhnthn.exec:\nhnthn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\frlrxfr.exec:\frlrxfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\hhbtnh.exec:\hhbtnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\ppvjd.exec:\ppvjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\xlffllf.exec:\xlffllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\hbthth.exec:\hbthth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\dvddj.exec:\dvddj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\xrffrrl.exec:\xrffrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\vppvd.exec:\vppvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\9vppv.exec:\9vppv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\hbnntt.exec:\hbnntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\hbnbhn.exec:\hbnbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\lfrxrlr.exec:\lfrxrlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\lrrlxxl.exec:\lrrlxxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\jjjjv.exec:\jjjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\pvvvd.exec:\pvvvd.exe17⤵
- Executes dropped EXE
PID:2032 -
\??\c:\lrflfll.exec:\lrflfll.exe18⤵
- Executes dropped EXE
PID:624 -
\??\c:\bhbnbb.exec:\bhbnbb.exe19⤵
- Executes dropped EXE
PID:2460 -
\??\c:\fxlfffr.exec:\fxlfffr.exe20⤵
- Executes dropped EXE
PID:1740 -
\??\c:\9xrfxfx.exec:\9xrfxfx.exe21⤵
- Executes dropped EXE
PID:296 -
\??\c:\pppjv.exec:\pppjv.exe22⤵
- Executes dropped EXE
PID:2748 -
\??\c:\fxfxrff.exec:\fxfxrff.exe23⤵
- Executes dropped EXE
PID:2548 -
\??\c:\ttnnth.exec:\ttnnth.exe24⤵
- Executes dropped EXE
PID:2908 -
\??\c:\7rfxffl.exec:\7rfxffl.exe25⤵
- Executes dropped EXE
PID:2900 -
\??\c:\xlrrrrx.exec:\xlrrrrx.exe26⤵
- Executes dropped EXE
PID:1316 -
\??\c:\ddppd.exec:\ddppd.exe27⤵
- Executes dropped EXE
PID:344 -
\??\c:\5lfxrxf.exec:\5lfxrxf.exe28⤵
- Executes dropped EXE
PID:468 -
\??\c:\htbbbt.exec:\htbbbt.exe29⤵
- Executes dropped EXE
PID:1776 -
\??\c:\dppjj.exec:\dppjj.exe30⤵
- Executes dropped EXE
PID:1648 -
\??\c:\xxffxxr.exec:\xxffxxr.exe31⤵
- Executes dropped EXE
PID:600 -
\??\c:\3htbhh.exec:\3htbhh.exe32⤵
- Executes dropped EXE
PID:2224 -
\??\c:\vpjdj.exec:\vpjdj.exe33⤵
- Executes dropped EXE
PID:2988 -
\??\c:\7nhnbh.exec:\7nhnbh.exe34⤵
- Executes dropped EXE
PID:876 -
\??\c:\tnnnnn.exec:\tnnnnn.exe35⤵
- Executes dropped EXE
PID:2080 -
\??\c:\pdjjj.exec:\pdjjj.exe36⤵
- Executes dropped EXE
PID:1612 -
\??\c:\rfxfflx.exec:\rfxfflx.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2108 -
\??\c:\5frflrx.exec:\5frflrx.exe38⤵
- Executes dropped EXE
PID:1200 -
\??\c:\hhbnnt.exec:\hhbnnt.exe39⤵
- Executes dropped EXE
PID:2480 -
\??\c:\pppdv.exec:\pppdv.exe40⤵
- Executes dropped EXE
PID:2124 -
\??\c:\3xllfxf.exec:\3xllfxf.exe41⤵
- Executes dropped EXE
PID:3016 -
\??\c:\rlxllrr.exec:\rlxllrr.exe42⤵
- Executes dropped EXE
PID:2752 -
\??\c:\bntntn.exec:\bntntn.exe43⤵
- Executes dropped EXE
PID:1244 -
\??\c:\vpdjp.exec:\vpdjp.exe44⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pppvd.exec:\pppvd.exe45⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xlxlrrf.exec:\xlxlrrf.exe46⤵
- Executes dropped EXE
PID:2792 -
\??\c:\bnbnbt.exec:\bnbnbt.exe47⤵
- Executes dropped EXE
PID:1060 -
\??\c:\bbbnht.exec:\bbbnht.exe48⤵
- Executes dropped EXE
PID:2600 -
\??\c:\jjdpj.exec:\jjdpj.exe49⤵
- Executes dropped EXE
PID:2808 -
\??\c:\7xxlrxf.exec:\7xxlrxf.exe50⤵
- Executes dropped EXE
PID:2796 -
\??\c:\rllxrlr.exec:\rllxrlr.exe51⤵
- Executes dropped EXE
PID:2572 -
\??\c:\bbnnnn.exec:\bbnnnn.exe52⤵
- Executes dropped EXE
PID:2236 -
\??\c:\jdvjj.exec:\jdvjj.exe53⤵
- Executes dropped EXE
PID:1392 -
\??\c:\lxfrfrl.exec:\lxfrfrl.exe54⤵
- Executes dropped EXE
PID:2044 -
\??\c:\lllxxxr.exec:\lllxxxr.exe55⤵
- Executes dropped EXE
PID:1248 -
\??\c:\hhbhnb.exec:\hhbhnb.exe56⤵
- Executes dropped EXE
PID:1956 -
\??\c:\pppdp.exec:\pppdp.exe57⤵
- Executes dropped EXE
PID:1692 -
\??\c:\pjvvd.exec:\pjvvd.exe58⤵
- Executes dropped EXE
PID:624 -
\??\c:\xrxfrrr.exec:\xrxfrrr.exe59⤵
- Executes dropped EXE
PID:1056 -
\??\c:\hbbhnh.exec:\hbbhnh.exe60⤵
- Executes dropped EXE
PID:1940 -
\??\c:\bthbhh.exec:\bthbhh.exe61⤵
- Executes dropped EXE
PID:1408 -
\??\c:\ddvdv.exec:\ddvdv.exe62⤵
- Executes dropped EXE
PID:1792 -
\??\c:\llfrxxl.exec:\llfrxxl.exe63⤵
- Executes dropped EXE
PID:2844 -
\??\c:\lllrrxf.exec:\lllrrxf.exe64⤵
- Executes dropped EXE
PID:2824 -
\??\c:\nnhbtn.exec:\nnhbtn.exe65⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pppjv.exec:\pppjv.exe66⤵PID:700
-
\??\c:\jdvdv.exec:\jdvdv.exe67⤵PID:1484
-
\??\c:\xxxlxlf.exec:\xxxlxlf.exe68⤵PID:984
-
\??\c:\btbnbh.exec:\btbnbh.exe69⤵PID:2656
-
\??\c:\1bbbnb.exec:\1bbbnb.exe70⤵PID:888
-
\??\c:\5vvdv.exec:\5vvdv.exe71⤵PID:1504
-
\??\c:\fllrfrf.exec:\fllrfrf.exe72⤵PID:788
-
\??\c:\hbttnn.exec:\hbttnn.exe73⤵PID:268
-
\??\c:\pjjpj.exec:\pjjpj.exe74⤵PID:2512
-
\??\c:\pjdjv.exec:\pjdjv.exe75⤵PID:1816
-
\??\c:\rfffrlx.exec:\rfffrlx.exe76⤵PID:980
-
\??\c:\tbtnnb.exec:\tbtnnb.exe77⤵PID:2496
-
\??\c:\ntbntn.exec:\ntbntn.exe78⤵PID:2144
-
\??\c:\pjvvd.exec:\pjvvd.exe79⤵PID:2472
-
\??\c:\rlffxlx.exec:\rlffxlx.exe80⤵PID:2416
-
\??\c:\btnbbh.exec:\btnbbh.exe81⤵PID:2324
-
\??\c:\ntthth.exec:\ntthth.exe82⤵PID:2056
-
\??\c:\1vvdv.exec:\1vvdv.exe83⤵PID:1808
-
\??\c:\rxrlflf.exec:\rxrlflf.exe84⤵PID:1908
-
\??\c:\llxxrrr.exec:\llxxrrr.exe85⤵PID:2136
-
\??\c:\tttnhn.exec:\tttnhn.exe86⤵PID:2956
-
\??\c:\hhbhbn.exec:\hhbhbn.exe87⤵PID:2120
-
\??\c:\vjppd.exec:\vjppd.exe88⤵PID:2756
-
\??\c:\lflfrxf.exec:\lflfrxf.exe89⤵PID:2784
-
\??\c:\ffrxfrr.exec:\ffrxfrr.exe90⤵PID:1660
-
\??\c:\htbntt.exec:\htbntt.exe91⤵PID:2716
-
\??\c:\5vpvj.exec:\5vpvj.exe92⤵PID:2816
-
\??\c:\jvjpv.exec:\jvjpv.exe93⤵PID:2964
-
\??\c:\9xrxlxr.exec:\9xrxlxr.exe94⤵PID:2600
-
\??\c:\nhttbb.exec:\nhttbb.exe95⤵PID:2592
-
\??\c:\tttbbh.exec:\tttbbh.exe96⤵PID:2604
-
\??\c:\jjdpj.exec:\jjdpj.exe97⤵PID:2632
-
\??\c:\vdvvj.exec:\vdvvj.exe98⤵
- System Location Discovery: System Language Discovery
PID:1324 -
\??\c:\lrrfrxr.exec:\lrrfrxr.exe99⤵PID:2608
-
\??\c:\nnbnbn.exec:\nnbnbn.exe100⤵PID:1500
-
\??\c:\hhhbth.exec:\hhhbth.exe101⤵PID:2044
-
\??\c:\vvvjd.exec:\vvvjd.exe102⤵PID:1812
-
\??\c:\jjdvj.exec:\jjdvj.exe103⤵PID:1956
-
\??\c:\lfxlxfx.exec:\lfxlxfx.exe104⤵PID:1692
-
\??\c:\3ffllrx.exec:\3ffllrx.exe105⤵PID:1804
-
\??\c:\9btbhh.exec:\9btbhh.exe106⤵PID:2460
-
\??\c:\djjjv.exec:\djjjv.exe107⤵PID:1740
-
\??\c:\jjvdv.exec:\jjvdv.exe108⤵PID:2112
-
\??\c:\rflrffl.exec:\rflrffl.exe109⤵PID:2628
-
\??\c:\1fxfrfl.exec:\1fxfrfl.exe110⤵PID:296
-
\??\c:\tnnhbb.exec:\tnnhbb.exe111⤵
- System Location Discovery: System Language Discovery
PID:2916 -
\??\c:\jjvdp.exec:\jjvdp.exe112⤵PID:2404
-
\??\c:\pjjjv.exec:\pjjjv.exe113⤵PID:2908
-
\??\c:\frxrrrr.exec:\frxrrrr.exe114⤵PID:700
-
\??\c:\lfxrlxl.exec:\lfxrlxl.exe115⤵PID:644
-
\??\c:\7thhnb.exec:\7thhnb.exe116⤵PID:1860
-
\??\c:\bbbtnb.exec:\bbbtnb.exe117⤵PID:2656
-
\??\c:\pdjdv.exec:\pdjdv.exe118⤵PID:888
-
\??\c:\3rrfxrf.exec:\3rrfxrf.exe119⤵PID:1552
-
\??\c:\fffrllx.exec:\fffrllx.exe120⤵PID:584
-
\??\c:\tttnnt.exec:\tttnnt.exe121⤵PID:3004
-
\??\c:\nhthht.exec:\nhthht.exe122⤵PID:2068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-