Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 16:21
Behavioral task
behavioral1
Sample
fb273477f01f039697267d0f935359def107bd3de40c46d5a1fcc8a293c5986d.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
fb273477f01f039697267d0f935359def107bd3de40c46d5a1fcc8a293c5986d.exe
-
Size
333KB
-
MD5
c07781df4d75a4389faa9120291242c9
-
SHA1
264bc837143241f227398c07d881e0d13efe5f98
-
SHA256
fb273477f01f039697267d0f935359def107bd3de40c46d5a1fcc8a293c5986d
-
SHA512
a049a039e0022a298fe1f19b48202dd35344cb02fde34e6455052d1e0ceac4f746a77e1bb6262ca9a1143e61de87c975a6b56ec554078413f5119070e0130053
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeRZ:R4wFHoSHYHUrAwfMp3CDRZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2088-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-68-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2612-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1836-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1644-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1972-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/484-150-0x0000000000260000-0x0000000000287000-memory.dmp family_blackmoon behavioral1/memory/484-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1084-163-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1084-162-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2948-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-230-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2376-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1044-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2304-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2336-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1988-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1912-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1924-404-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2344-410-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3068-416-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2964-422-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2948-474-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1480-473-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1124-509-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1544-510-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/3052-534-0x00000000775F0000-0x000000007770F000-memory.dmp family_blackmoon behavioral1/memory/2612-604-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-13205-0x00000000775F0000-0x000000007770F000-memory.dmp family_blackmoon behavioral1/memory/3052-14309-0x00000000775F0000-0x000000007770F000-memory.dmp family_blackmoon behavioral1/memory/3052-19803-0x00000000775F0000-0x000000007770F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2484 nnnbtt.exe 2164 9dvpd.exe 2864 ddvdj.exe 2844 3rlrfrf.exe 2636 ppppd.exe 2768 9dpvd.exe 2612 hhthbb.exe 1728 pjdjv.exe 1836 hbbnbn.exe 3048 pppjp.exe 2452 rrlfrxl.exe 1644 bbnthn.exe 1712 rrllxfr.exe 1972 bthbhh.exe 2344 5jjdp.exe 2672 bnbbnb.exe 484 ddpvj.exe 1084 lxlflrl.exe 2012 jjddj.exe 2580 vpdjv.exe 2948 1ntnnn.exe 2444 1jvpv.exe 3012 7bntbb.exe 1760 dvjpp.exe 2448 hbntht.exe 2376 pjvvd.exe 984 thbnth.exe 692 5pdjj.exe 1044 thttbt.exe 2500 5pdjp.exe 2304 lfrflrx.exe 2524 bththt.exe 2328 ppppj.exe 2160 fxrfrrf.exe 1568 hbnnnn.exe 2820 jdpvp.exe 2708 fxfrrxf.exe 2860 xxrfrxf.exe 2988 thttbb.exe 2624 vpjjv.exe 2772 rlxrllx.exe 2656 xxrxrfl.exe 2668 bhthtb.exe 2336 1dpvj.exe 2272 lllxfxr.exe 376 rlfrxfl.exe 2884 bnhbbt.exe 2220 3jddj.exe 2520 lfxxfxf.exe 2852 hhbnbt.exe 1988 jvdvd.exe 1280 9vddp.exe 1912 lxffxxf.exe 1924 nnhbtb.exe 2344 djjvj.exe 3068 7xxrxfl.exe 2964 3xxxfrf.exe 484 tttnnh.exe 1084 1pjvj.exe 544 5vdpd.exe 740 9xxfrrx.exe 2424 hbbhtt.exe 2948 5vpdv.exe 3016 pjdpd.exe -
resource yara_rule behavioral1/memory/2088-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2088-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001211a-7.dat upx behavioral1/files/0x00080000000161f6-17.dat upx behavioral1/memory/2484-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016307-23.dat upx behavioral1/memory/2164-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001658c-33.dat upx behavioral1/memory/2864-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016855-41.dat upx behavioral1/memory/2844-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2636-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016aa9-51.dat upx behavioral1/files/0x0007000000016c62-59.dat upx behavioral1/memory/2768-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2612-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c84-69.dat upx behavioral1/files/0x00080000000173da-77.dat upx behavioral1/memory/1836-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173f1-86.dat upx behavioral1/files/0x00060000000173f4-94.dat upx behavioral1/files/0x00060000000173fc-103.dat upx behavioral1/memory/2452-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017472-111.dat upx behavioral1/memory/1644-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017487-121.dat upx behavioral1/memory/1712-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1972-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174a2-128.dat upx behavioral1/memory/2344-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017525-137.dat upx behavioral1/files/0x0014000000018663-145.dat upx behavioral1/memory/2672-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0036000000015f81-154.dat upx behavioral1/memory/484-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d00000001866e-164.dat upx behavioral1/files/0x0005000000018687-172.dat upx behavioral1/memory/2580-179-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000018792-180.dat upx behavioral1/files/0x0006000000018c1a-189.dat upx behavioral1/memory/2948-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018c26-196.dat upx behavioral1/files/0x0006000000018f53-205.dat upx behavioral1/memory/3012-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001903b-212.dat upx behavioral1/memory/2448-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000190ce-220.dat upx behavioral1/files/0x00060000000190e0-227.dat upx behavioral1/memory/2376-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191d4-237.dat upx behavioral1/files/0x00050000000191ff-244.dat upx behavioral1/memory/1044-246-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001922c-252.dat upx behavioral1/memory/2500-253-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019244-262.dat upx behavioral1/files/0x0005000000019256-270.dat upx behavioral1/memory/2304-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2708-302-0x00000000003A0000-0x00000000003C7000-memory.dmp upx behavioral1/memory/2860-311-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2772-328-0x00000000002A0000-0x00000000002C7000-memory.dmp upx behavioral1/memory/2336-345-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2272-346-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2884-364-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1988-386-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbnn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2484 2088 fb273477f01f039697267d0f935359def107bd3de40c46d5a1fcc8a293c5986d.exe 30 PID 2088 wrote to memory of 2484 2088 fb273477f01f039697267d0f935359def107bd3de40c46d5a1fcc8a293c5986d.exe 30 PID 2088 wrote to memory of 2484 2088 fb273477f01f039697267d0f935359def107bd3de40c46d5a1fcc8a293c5986d.exe 30 PID 2088 wrote to memory of 2484 2088 fb273477f01f039697267d0f935359def107bd3de40c46d5a1fcc8a293c5986d.exe 30 PID 2484 wrote to memory of 2164 2484 nnnbtt.exe 31 PID 2484 wrote to memory of 2164 2484 nnnbtt.exe 31 PID 2484 wrote to memory of 2164 2484 nnnbtt.exe 31 PID 2484 wrote to memory of 2164 2484 nnnbtt.exe 31 PID 2164 wrote to memory of 2864 2164 9dvpd.exe 32 PID 2164 wrote to memory of 2864 2164 9dvpd.exe 32 PID 2164 wrote to memory of 2864 2164 9dvpd.exe 32 PID 2164 wrote to memory of 2864 2164 9dvpd.exe 32 PID 2864 wrote to memory of 2844 2864 ddvdj.exe 33 PID 2864 wrote to memory of 2844 2864 ddvdj.exe 33 PID 2864 wrote to memory of 2844 2864 ddvdj.exe 33 PID 2864 wrote to memory of 2844 2864 ddvdj.exe 33 PID 2844 wrote to memory of 2636 2844 3rlrfrf.exe 34 PID 2844 wrote to memory of 2636 2844 3rlrfrf.exe 34 PID 2844 wrote to memory of 2636 2844 3rlrfrf.exe 34 PID 2844 wrote to memory of 2636 2844 3rlrfrf.exe 34 PID 2636 wrote to memory of 2768 2636 ppppd.exe 35 PID 2636 wrote to memory of 2768 2636 ppppd.exe 35 PID 2636 wrote to memory of 2768 2636 ppppd.exe 35 PID 2636 wrote to memory of 2768 2636 ppppd.exe 35 PID 2768 wrote to memory of 2612 2768 9dpvd.exe 36 PID 2768 wrote to memory of 2612 2768 9dpvd.exe 36 PID 2768 wrote to memory of 2612 2768 9dpvd.exe 36 PID 2768 wrote to memory of 2612 2768 9dpvd.exe 36 PID 2612 wrote to memory of 1728 2612 hhthbb.exe 37 PID 2612 wrote to memory of 1728 2612 hhthbb.exe 37 PID 2612 wrote to memory of 1728 2612 hhthbb.exe 37 PID 2612 wrote to memory of 1728 2612 hhthbb.exe 37 PID 1728 wrote to memory of 1836 1728 pjdjv.exe 38 PID 1728 wrote to memory of 1836 1728 pjdjv.exe 38 PID 1728 wrote to memory of 1836 1728 pjdjv.exe 38 PID 1728 wrote to memory of 1836 1728 pjdjv.exe 38 PID 1836 wrote to memory of 3048 1836 hbbnbn.exe 39 PID 1836 wrote to memory of 3048 1836 hbbnbn.exe 39 PID 1836 wrote to memory of 3048 1836 hbbnbn.exe 39 PID 1836 wrote to memory of 3048 1836 hbbnbn.exe 39 PID 3048 wrote to memory of 2452 3048 pppjp.exe 40 PID 3048 wrote to memory of 2452 3048 pppjp.exe 40 PID 3048 wrote to memory of 2452 3048 pppjp.exe 40 PID 3048 wrote to memory of 2452 3048 pppjp.exe 40 PID 2452 wrote to memory of 1644 2452 rrlfrxl.exe 41 PID 2452 wrote to memory of 1644 2452 rrlfrxl.exe 41 PID 2452 wrote to memory of 1644 2452 rrlfrxl.exe 41 PID 2452 wrote to memory of 1644 2452 rrlfrxl.exe 41 PID 1644 wrote to memory of 1712 1644 bbnthn.exe 42 PID 1644 wrote to memory of 1712 1644 bbnthn.exe 42 PID 1644 wrote to memory of 1712 1644 bbnthn.exe 42 PID 1644 wrote to memory of 1712 1644 bbnthn.exe 42 PID 1712 wrote to memory of 1972 1712 rrllxfr.exe 43 PID 1712 wrote to memory of 1972 1712 rrllxfr.exe 43 PID 1712 wrote to memory of 1972 1712 rrllxfr.exe 43 PID 1712 wrote to memory of 1972 1712 rrllxfr.exe 43 PID 1972 wrote to memory of 2344 1972 bthbhh.exe 44 PID 1972 wrote to memory of 2344 1972 bthbhh.exe 44 PID 1972 wrote to memory of 2344 1972 bthbhh.exe 44 PID 1972 wrote to memory of 2344 1972 bthbhh.exe 44 PID 2344 wrote to memory of 2672 2344 5jjdp.exe 45 PID 2344 wrote to memory of 2672 2344 5jjdp.exe 45 PID 2344 wrote to memory of 2672 2344 5jjdp.exe 45 PID 2344 wrote to memory of 2672 2344 5jjdp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb273477f01f039697267d0f935359def107bd3de40c46d5a1fcc8a293c5986d.exe"C:\Users\Admin\AppData\Local\Temp\fb273477f01f039697267d0f935359def107bd3de40c46d5a1fcc8a293c5986d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\nnnbtt.exec:\nnnbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\9dvpd.exec:\9dvpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\ddvdj.exec:\ddvdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\3rlrfrf.exec:\3rlrfrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\ppppd.exec:\ppppd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\9dpvd.exec:\9dpvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\hhthbb.exec:\hhthbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\pjdjv.exec:\pjdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\hbbnbn.exec:\hbbnbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\pppjp.exec:\pppjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\rrlfrxl.exec:\rrlfrxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\bbnthn.exec:\bbnthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\rrllxfr.exec:\rrllxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\bthbhh.exec:\bthbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\5jjdp.exec:\5jjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\bnbbnb.exec:\bnbbnb.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2672 -
\??\c:\ddpvj.exec:\ddpvj.exe18⤵
- Executes dropped EXE
PID:484 -
\??\c:\lxlflrl.exec:\lxlflrl.exe19⤵
- Executes dropped EXE
PID:1084 -
\??\c:\jjddj.exec:\jjddj.exe20⤵
- Executes dropped EXE
PID:2012 -
\??\c:\vpdjv.exec:\vpdjv.exe21⤵
- Executes dropped EXE
PID:2580 -
\??\c:\1ntnnn.exec:\1ntnnn.exe22⤵
- Executes dropped EXE
PID:2948 -
\??\c:\1jvpv.exec:\1jvpv.exe23⤵
- Executes dropped EXE
PID:2444 -
\??\c:\7bntbb.exec:\7bntbb.exe24⤵
- Executes dropped EXE
PID:3012 -
\??\c:\dvjpp.exec:\dvjpp.exe25⤵
- Executes dropped EXE
PID:1760 -
\??\c:\hbntht.exec:\hbntht.exe26⤵
- Executes dropped EXE
PID:2448 -
\??\c:\pjvvd.exec:\pjvvd.exe27⤵
- Executes dropped EXE
PID:2376 -
\??\c:\thbnth.exec:\thbnth.exe28⤵
- Executes dropped EXE
PID:984 -
\??\c:\5pdjj.exec:\5pdjj.exe29⤵
- Executes dropped EXE
PID:692 -
\??\c:\thttbt.exec:\thttbt.exe30⤵
- Executes dropped EXE
PID:1044 -
\??\c:\5pdjp.exec:\5pdjp.exe31⤵
- Executes dropped EXE
PID:2500 -
\??\c:\lfrflrx.exec:\lfrflrx.exe32⤵
- Executes dropped EXE
PID:2304 -
\??\c:\bththt.exec:\bththt.exe33⤵
- Executes dropped EXE
PID:2524 -
\??\c:\ppppj.exec:\ppppj.exe34⤵
- Executes dropped EXE
PID:2328 -
\??\c:\fxrfrrf.exec:\fxrfrrf.exe35⤵
- Executes dropped EXE
PID:2160 -
\??\c:\hbnnnn.exec:\hbnnnn.exe36⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jdpvp.exec:\jdpvp.exe37⤵
- Executes dropped EXE
PID:2820 -
\??\c:\fxfrrxf.exec:\fxfrrxf.exe38⤵
- Executes dropped EXE
PID:2708 -
\??\c:\xxrfrxf.exec:\xxrfrxf.exe39⤵
- Executes dropped EXE
PID:2860 -
\??\c:\thttbb.exec:\thttbb.exe40⤵
- Executes dropped EXE
PID:2988 -
\??\c:\vpjjv.exec:\vpjjv.exe41⤵
- Executes dropped EXE
PID:2624 -
\??\c:\rlxrllx.exec:\rlxrllx.exe42⤵
- Executes dropped EXE
PID:2772 -
\??\c:\xxrxrfl.exec:\xxrxrfl.exe43⤵
- Executes dropped EXE
PID:2656 -
\??\c:\bhthtb.exec:\bhthtb.exe44⤵
- Executes dropped EXE
PID:2668 -
\??\c:\1dpvj.exec:\1dpvj.exe45⤵
- Executes dropped EXE
PID:2336 -
\??\c:\lllxfxr.exec:\lllxfxr.exe46⤵
- Executes dropped EXE
PID:2272 -
\??\c:\rlfrxfl.exec:\rlfrxfl.exe47⤵
- Executes dropped EXE
PID:376 -
\??\c:\bnhbbt.exec:\bnhbbt.exe48⤵
- Executes dropped EXE
PID:2884 -
\??\c:\3jddj.exec:\3jddj.exe49⤵
- Executes dropped EXE
PID:2220 -
\??\c:\lfxxfxf.exec:\lfxxfxf.exe50⤵
- Executes dropped EXE
PID:2520 -
\??\c:\hhbnbt.exec:\hhbnbt.exe51⤵
- Executes dropped EXE
PID:2852 -
\??\c:\jvdvd.exec:\jvdvd.exe52⤵
- Executes dropped EXE
PID:1988 -
\??\c:\9vddp.exec:\9vddp.exe53⤵
- Executes dropped EXE
PID:1280 -
\??\c:\lxffxxf.exec:\lxffxxf.exe54⤵
- Executes dropped EXE
PID:1912 -
\??\c:\nnhbtb.exec:\nnhbtb.exe55⤵
- Executes dropped EXE
PID:1924 -
\??\c:\djjvj.exec:\djjvj.exe56⤵
- Executes dropped EXE
PID:2344 -
\??\c:\7xxrxfl.exec:\7xxrxfl.exe57⤵
- Executes dropped EXE
PID:3068 -
\??\c:\3xxxfrf.exec:\3xxxfrf.exe58⤵
- Executes dropped EXE
PID:2964 -
\??\c:\tttnnh.exec:\tttnnh.exe59⤵
- Executes dropped EXE
PID:484 -
\??\c:\1pjvj.exec:\1pjvj.exe60⤵
- Executes dropped EXE
PID:1084 -
\??\c:\5vdpd.exec:\5vdpd.exe61⤵
- Executes dropped EXE
PID:544 -
\??\c:\9xxfrrx.exec:\9xxfrrx.exe62⤵
- Executes dropped EXE
PID:740 -
\??\c:\hbbhtt.exec:\hbbhtt.exe63⤵
- Executes dropped EXE
PID:2424 -
\??\c:\5vpdv.exec:\5vpdv.exe64⤵
- Executes dropped EXE
PID:2948 -
\??\c:\pjdpd.exec:\pjdpd.exe65⤵
- Executes dropped EXE
PID:3016 -
\??\c:\fxrrxxl.exec:\fxrrxxl.exe66⤵PID:2016
-
\??\c:\ttnntb.exec:\ttnntb.exe67⤵PID:1480
-
\??\c:\dvdjv.exec:\dvdjv.exe68⤵PID:2260
-
\??\c:\9ppvj.exec:\9ppvj.exe69⤵PID:2448
-
\??\c:\llfxflf.exec:\llfxflf.exe70⤵PID:1544
-
\??\c:\rlrxrll.exec:\rlrxrll.exe71⤵PID:560
-
\??\c:\9nnbbh.exec:\9nnbbh.exe72⤵PID:1052
-
\??\c:\jdpjd.exec:\jdpjd.exe73⤵PID:1124
-
\??\c:\lfrxlrf.exec:\lfrxlrf.exe74⤵PID:2380
-
\??\c:\ttnnbn.exec:\ttnnbn.exe75⤵PID:804
-
\??\c:\btntbh.exec:\btntbh.exe76⤵PID:1740
-
\??\c:\dpjpd.exec:\dpjpd.exe77⤵PID:2788
-
\??\c:\rxrlxlx.exec:\rxrlxlx.exe78⤵PID:3052
-
\??\c:\5xxrflr.exec:\5xxrflr.exe79⤵PID:2088
-
\??\c:\vdpvp.exec:\vdpvp.exe80⤵PID:2812
-
\??\c:\fxrxrrf.exec:\fxrxrrf.exe81⤵PID:1812
-
\??\c:\ttthbh.exec:\ttthbh.exe82⤵PID:2816
-
\??\c:\5jpvd.exec:\5jpvd.exe83⤵PID:2756
-
\??\c:\ddvdp.exec:\ddvdp.exe84⤵PID:2264
-
\??\c:\9lfllxf.exec:\9lfllxf.exe85⤵PID:2156
-
\??\c:\9hhhnt.exec:\9hhhnt.exe86⤵PID:1576
-
\??\c:\hbtbnn.exec:\hbtbnn.exe87⤵PID:2636
-
\??\c:\djdvj.exec:\djdvj.exe88⤵PID:2596
-
\??\c:\vdpjp.exec:\vdpjp.exe89⤵PID:1956
-
\??\c:\lfxxffl.exec:\lfxxffl.exe90⤵PID:2612
-
\??\c:\3tbtbb.exec:\3tbtbb.exe91⤵PID:1620
-
\??\c:\vvvjp.exec:\vvvjp.exe92⤵PID:1836
-
\??\c:\jdppv.exec:\jdppv.exe93⤵PID:1804
-
\??\c:\fxlfllx.exec:\fxlfllx.exe94⤵PID:1792
-
\??\c:\nnhtnn.exec:\nnhtnn.exe95⤵PID:2220
-
\??\c:\btbhnn.exec:\btbhnn.exe96⤵PID:536
-
\??\c:\vvjpv.exec:\vvjpv.exe97⤵PID:1992
-
\??\c:\3xrfffr.exec:\3xrfffr.exe98⤵PID:1312
-
\??\c:\1xrrxxf.exec:\1xrrxxf.exe99⤵PID:1280
-
\??\c:\nntttb.exec:\nntttb.exe100⤵
- System Location Discovery: System Language Discovery
PID:2924 -
\??\c:\nhbtbn.exec:\nhbtbn.exe101⤵PID:864
-
\??\c:\7pvvd.exec:\7pvvd.exe102⤵PID:2920
-
\??\c:\3vvpd.exec:\3vvpd.exe103⤵PID:572
-
\??\c:\7rlrrxf.exec:\7rlrrxf.exe104⤵PID:568
-
\??\c:\hhtbnn.exec:\hhtbnn.exe105⤵PID:1556
-
\??\c:\nntnbh.exec:\nntnbh.exe106⤵PID:2012
-
\??\c:\1jdjv.exec:\1jdjv.exe107⤵PID:2584
-
\??\c:\ppjjp.exec:\ppjjp.exe108⤵PID:1672
-
\??\c:\1xffrxr.exec:\1xffrxr.exe109⤵PID:2456
-
\??\c:\tnhnnt.exec:\tnhnnt.exe110⤵PID:2176
-
\??\c:\bttbhb.exec:\bttbhb.exe111⤵PID:496
-
\??\c:\5vjvd.exec:\5vjvd.exe112⤵PID:1308
-
\??\c:\ppjdp.exec:\ppjdp.exe113⤵PID:2184
-
\??\c:\fxlxxfl.exec:\fxlxxfl.exe114⤵PID:2260
-
\??\c:\bbnthh.exec:\bbnthh.exe115⤵PID:2448
-
\??\c:\7bhhnb.exec:\7bhhnb.exe116⤵PID:3028
-
\??\c:\3vjvd.exec:\3vjvd.exe117⤵PID:560
-
\??\c:\lfrllxr.exec:\lfrllxr.exe118⤵PID:2868
-
\??\c:\fxflrxl.exec:\fxflrxl.exe119⤵PID:1676
-
\??\c:\tnnbht.exec:\tnnbht.exe120⤵PID:796
-
\??\c:\bnhnnn.exec:\bnhnnn.exe121⤵PID:2148
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-