Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 11:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cab5a9e5d2efd344fefb74ad68f5da9c6e3b8c0d97d5ae51e7e5cf42a32e3384.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
cab5a9e5d2efd344fefb74ad68f5da9c6e3b8c0d97d5ae51e7e5cf42a32e3384.exe
-
Size
453KB
-
MD5
59655a252f32ecd9ef7ba0614d008394
-
SHA1
9bd9164696d6bbde5a8b80eee2b113dd4fd1c5b2
-
SHA256
cab5a9e5d2efd344fefb74ad68f5da9c6e3b8c0d97d5ae51e7e5cf42a32e3384
-
SHA512
424a5af64d54f92b56dc6e784498631533efd13a5bb62852780e411ce206ff2d43f52c075d1ca49eee4b96815876a25b5af03801d415802ceb6077b8c2f1a146
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeB:q7Tc2NYHUrAwfMp3CDB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2672-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-128-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1316-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-177-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/824-186-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1644-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1828-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-212-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/888-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-250-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1528-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1176-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1176-309-0x0000000076EF0000-0x0000000076FEA000-memory.dmp family_blackmoon behavioral1/memory/1176-308-0x0000000076FF0000-0x000000007710F000-memory.dmp family_blackmoon behavioral1/memory/2696-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-461-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/876-522-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1488-789-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2188 1htbbh.exe 2864 fxxrxrl.exe 2892 nhbtbh.exe 2584 hbthbb.exe 2792 ddddp.exe 2640 7nnhnn.exe 2308 1jdpv.exe 2228 bhttbh.exe 1680 5dvvj.exe 1804 thtntn.exe 2828 ppjpd.exe 2920 btthhb.exe 1316 5ddjd.exe 1632 ttnbbh.exe 264 3pddj.exe 2120 7djpv.exe 2208 7xrffxx.exe 824 3vjpv.exe 1828 ppjvj.exe 1644 ppddj.exe 764 dvdvd.exe 888 vjjvd.exe 3064 dvddd.exe 2972 pdjjv.exe 1884 5xflrxl.exe 1528 7nnntb.exe 2324 jdvdj.exe 1976 nhbhnn.exe 1192 pjjvj.exe 1776 bbtbnn.exe 1740 vjvdp.exe 1176 ttbbnh.exe 2788 7bttbn.exe 2568 pjdjv.exe 2696 9rfllrf.exe 2820 rxrffll.exe 2612 bnhnnh.exe 2556 ddvdp.exe 2736 rrflrxr.exe 2072 nnthtt.exe 2684 pdvvp.exe 2164 dvppd.exe 2284 nnbhtt.exe 2288 thtbhh.exe 2908 vvjpj.exe 2664 rxrfrrl.exe 2844 hbthnh.exe 2516 jjvdp.exe 2920 pddvj.exe 2252 xfffllx.exe 592 nnnntt.exe 796 hhbhth.exe 264 pjvpp.exe 1956 rfllfrx.exe 2416 htnntn.exe 2368 dpddj.exe 1076 pdjvv.exe 2968 5lxllff.exe 2004 bbnnnn.exe 1644 jvjdj.exe 2300 jjvpv.exe 684 rlxfllr.exe 876 nhbhnn.exe 1676 nhbttn.exe -
resource yara_rule behavioral1/memory/2672-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-789-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7htttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2188 2672 cab5a9e5d2efd344fefb74ad68f5da9c6e3b8c0d97d5ae51e7e5cf42a32e3384.exe 30 PID 2672 wrote to memory of 2188 2672 cab5a9e5d2efd344fefb74ad68f5da9c6e3b8c0d97d5ae51e7e5cf42a32e3384.exe 30 PID 2672 wrote to memory of 2188 2672 cab5a9e5d2efd344fefb74ad68f5da9c6e3b8c0d97d5ae51e7e5cf42a32e3384.exe 30 PID 2672 wrote to memory of 2188 2672 cab5a9e5d2efd344fefb74ad68f5da9c6e3b8c0d97d5ae51e7e5cf42a32e3384.exe 30 PID 2188 wrote to memory of 2864 2188 1htbbh.exe 31 PID 2188 wrote to memory of 2864 2188 1htbbh.exe 31 PID 2188 wrote to memory of 2864 2188 1htbbh.exe 31 PID 2188 wrote to memory of 2864 2188 1htbbh.exe 31 PID 2864 wrote to memory of 2892 2864 fxxrxrl.exe 32 PID 2864 wrote to memory of 2892 2864 fxxrxrl.exe 32 PID 2864 wrote to memory of 2892 2864 fxxrxrl.exe 32 PID 2864 wrote to memory of 2892 2864 fxxrxrl.exe 32 PID 2892 wrote to memory of 2584 2892 nhbtbh.exe 33 PID 2892 wrote to memory of 2584 2892 nhbtbh.exe 33 PID 2892 wrote to memory of 2584 2892 nhbtbh.exe 33 PID 2892 wrote to memory of 2584 2892 nhbtbh.exe 33 PID 2584 wrote to memory of 2792 2584 hbthbb.exe 34 PID 2584 wrote to memory of 2792 2584 hbthbb.exe 34 PID 2584 wrote to memory of 2792 2584 hbthbb.exe 34 PID 2584 wrote to memory of 2792 2584 hbthbb.exe 34 PID 2792 wrote to memory of 2640 2792 ddddp.exe 35 PID 2792 wrote to memory of 2640 2792 ddddp.exe 35 PID 2792 wrote to memory of 2640 2792 ddddp.exe 35 PID 2792 wrote to memory of 2640 2792 ddddp.exe 35 PID 2640 wrote to memory of 2308 2640 7nnhnn.exe 36 PID 2640 wrote to memory of 2308 2640 7nnhnn.exe 36 PID 2640 wrote to memory of 2308 2640 7nnhnn.exe 36 PID 2640 wrote to memory of 2308 2640 7nnhnn.exe 36 PID 2308 wrote to memory of 2228 2308 1jdpv.exe 37 PID 2308 wrote to memory of 2228 2308 1jdpv.exe 37 PID 2308 wrote to memory of 2228 2308 1jdpv.exe 37 PID 2308 wrote to memory of 2228 2308 1jdpv.exe 37 PID 2228 wrote to memory of 1680 2228 bhttbh.exe 38 PID 2228 wrote to memory of 1680 2228 bhttbh.exe 38 PID 2228 wrote to memory of 1680 2228 bhttbh.exe 38 PID 2228 wrote to memory of 1680 2228 bhttbh.exe 38 PID 1680 wrote to memory of 1804 1680 5dvvj.exe 39 PID 1680 wrote to memory of 1804 1680 5dvvj.exe 39 PID 1680 wrote to memory of 1804 1680 5dvvj.exe 39 PID 1680 wrote to memory of 1804 1680 5dvvj.exe 39 PID 1804 wrote to memory of 2828 1804 thtntn.exe 40 PID 1804 wrote to memory of 2828 1804 thtntn.exe 40 PID 1804 wrote to memory of 2828 1804 thtntn.exe 40 PID 1804 wrote to memory of 2828 1804 thtntn.exe 40 PID 2828 wrote to memory of 2920 2828 ppjpd.exe 41 PID 2828 wrote to memory of 2920 2828 ppjpd.exe 41 PID 2828 wrote to memory of 2920 2828 ppjpd.exe 41 PID 2828 wrote to memory of 2920 2828 ppjpd.exe 41 PID 2920 wrote to memory of 1316 2920 btthhb.exe 42 PID 2920 wrote to memory of 1316 2920 btthhb.exe 42 PID 2920 wrote to memory of 1316 2920 btthhb.exe 42 PID 2920 wrote to memory of 1316 2920 btthhb.exe 42 PID 1316 wrote to memory of 1632 1316 5ddjd.exe 43 PID 1316 wrote to memory of 1632 1316 5ddjd.exe 43 PID 1316 wrote to memory of 1632 1316 5ddjd.exe 43 PID 1316 wrote to memory of 1632 1316 5ddjd.exe 43 PID 1632 wrote to memory of 264 1632 ttnbbh.exe 44 PID 1632 wrote to memory of 264 1632 ttnbbh.exe 44 PID 1632 wrote to memory of 264 1632 ttnbbh.exe 44 PID 1632 wrote to memory of 264 1632 ttnbbh.exe 44 PID 264 wrote to memory of 2120 264 3pddj.exe 45 PID 264 wrote to memory of 2120 264 3pddj.exe 45 PID 264 wrote to memory of 2120 264 3pddj.exe 45 PID 264 wrote to memory of 2120 264 3pddj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\cab5a9e5d2efd344fefb74ad68f5da9c6e3b8c0d97d5ae51e7e5cf42a32e3384.exe"C:\Users\Admin\AppData\Local\Temp\cab5a9e5d2efd344fefb74ad68f5da9c6e3b8c0d97d5ae51e7e5cf42a32e3384.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\1htbbh.exec:\1htbbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\fxxrxrl.exec:\fxxrxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\nhbtbh.exec:\nhbtbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\hbthbb.exec:\hbthbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\ddddp.exec:\ddddp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\7nnhnn.exec:\7nnhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\1jdpv.exec:\1jdpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\bhttbh.exec:\bhttbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\5dvvj.exec:\5dvvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\thtntn.exec:\thtntn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\ppjpd.exec:\ppjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\btthhb.exec:\btthhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\5ddjd.exec:\5ddjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\ttnbbh.exec:\ttnbbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\3pddj.exec:\3pddj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\7djpv.exec:\7djpv.exe17⤵
- Executes dropped EXE
PID:2120 -
\??\c:\7xrffxx.exec:\7xrffxx.exe18⤵
- Executes dropped EXE
PID:2208 -
\??\c:\3vjpv.exec:\3vjpv.exe19⤵
- Executes dropped EXE
PID:824 -
\??\c:\ppjvj.exec:\ppjvj.exe20⤵
- Executes dropped EXE
PID:1828 -
\??\c:\ppddj.exec:\ppddj.exe21⤵
- Executes dropped EXE
PID:1644 -
\??\c:\dvdvd.exec:\dvdvd.exe22⤵
- Executes dropped EXE
PID:764 -
\??\c:\vjjvd.exec:\vjjvd.exe23⤵
- Executes dropped EXE
PID:888 -
\??\c:\dvddd.exec:\dvddd.exe24⤵
- Executes dropped EXE
PID:3064 -
\??\c:\pdjjv.exec:\pdjjv.exe25⤵
- Executes dropped EXE
PID:2972 -
\??\c:\5xflrxl.exec:\5xflrxl.exe26⤵
- Executes dropped EXE
PID:1884 -
\??\c:\7nnntb.exec:\7nnntb.exe27⤵
- Executes dropped EXE
PID:1528 -
\??\c:\jdvdj.exec:\jdvdj.exe28⤵
- Executes dropped EXE
PID:2324 -
\??\c:\nhbhnn.exec:\nhbhnn.exe29⤵
- Executes dropped EXE
PID:1976 -
\??\c:\pjjvj.exec:\pjjvj.exe30⤵
- Executes dropped EXE
PID:1192 -
\??\c:\bbtbnn.exec:\bbtbnn.exe31⤵
- Executes dropped EXE
PID:1776 -
\??\c:\vjvdp.exec:\vjvdp.exe32⤵
- Executes dropped EXE
PID:1740 -
\??\c:\ttbbnh.exec:\ttbbnh.exe33⤵
- Executes dropped EXE
PID:1176 -
\??\c:\vdvjv.exec:\vdvjv.exe34⤵PID:1092
-
\??\c:\7bttbn.exec:\7bttbn.exe35⤵
- Executes dropped EXE
PID:2788 -
\??\c:\pjdjv.exec:\pjdjv.exe36⤵
- Executes dropped EXE
PID:2568 -
\??\c:\9rfllrf.exec:\9rfllrf.exe37⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rxrffll.exec:\rxrffll.exe38⤵
- Executes dropped EXE
PID:2820 -
\??\c:\bnhnnh.exec:\bnhnnh.exe39⤵
- Executes dropped EXE
PID:2612 -
\??\c:\ddvdp.exec:\ddvdp.exe40⤵
- Executes dropped EXE
PID:2556 -
\??\c:\rrflrxr.exec:\rrflrxr.exe41⤵
- Executes dropped EXE
PID:2736 -
\??\c:\nnthtt.exec:\nnthtt.exe42⤵
- Executes dropped EXE
PID:2072 -
\??\c:\pdvvp.exec:\pdvvp.exe43⤵
- Executes dropped EXE
PID:2684 -
\??\c:\dvppd.exec:\dvppd.exe44⤵
- Executes dropped EXE
PID:2164 -
\??\c:\nnbhtt.exec:\nnbhtt.exe45⤵
- Executes dropped EXE
PID:2284 -
\??\c:\thtbhh.exec:\thtbhh.exe46⤵
- Executes dropped EXE
PID:2288 -
\??\c:\vvjpj.exec:\vvjpj.exe47⤵
- Executes dropped EXE
PID:2908 -
\??\c:\rxrfrrl.exec:\rxrfrrl.exe48⤵
- Executes dropped EXE
PID:2664 -
\??\c:\hbthnh.exec:\hbthnh.exe49⤵
- Executes dropped EXE
PID:2844 -
\??\c:\jjvdp.exec:\jjvdp.exe50⤵
- Executes dropped EXE
PID:2516 -
\??\c:\pddvj.exec:\pddvj.exe51⤵
- Executes dropped EXE
PID:2920 -
\??\c:\xfffllx.exec:\xfffllx.exe52⤵
- Executes dropped EXE
PID:2252 -
\??\c:\nnnntt.exec:\nnnntt.exe53⤵
- Executes dropped EXE
PID:592 -
\??\c:\hhbhth.exec:\hhbhth.exe54⤵
- Executes dropped EXE
PID:796 -
\??\c:\pjvpp.exec:\pjvpp.exe55⤵
- Executes dropped EXE
PID:264 -
\??\c:\rfllfrx.exec:\rfllfrx.exe56⤵
- Executes dropped EXE
PID:1956 -
\??\c:\htnntn.exec:\htnntn.exe57⤵
- Executes dropped EXE
PID:2416 -
\??\c:\dpddj.exec:\dpddj.exe58⤵
- Executes dropped EXE
PID:2368 -
\??\c:\pdjvv.exec:\pdjvv.exe59⤵
- Executes dropped EXE
PID:1076 -
\??\c:\5lxllff.exec:\5lxllff.exe60⤵
- Executes dropped EXE
PID:2968 -
\??\c:\bbnnnn.exec:\bbnnnn.exe61⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jvjdj.exec:\jvjdj.exe62⤵
- Executes dropped EXE
PID:1644 -
\??\c:\jjvpv.exec:\jjvpv.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2300 -
\??\c:\rlxfllr.exec:\rlxfllr.exe64⤵
- Executes dropped EXE
PID:684 -
\??\c:\nhbhnn.exec:\nhbhnn.exe65⤵
- Executes dropped EXE
PID:876 -
\??\c:\nhbttn.exec:\nhbttn.exe66⤵
- Executes dropped EXE
PID:1676 -
\??\c:\pjvdp.exec:\pjvdp.exe67⤵PID:2520
-
\??\c:\flllrlx.exec:\flllrlx.exe68⤵PID:636
-
\??\c:\hbtbbb.exec:\hbtbbb.exe69⤵PID:1884
-
\??\c:\bbbhtt.exec:\bbbhtt.exe70⤵PID:1528
-
\??\c:\jvvvv.exec:\jvvvv.exe71⤵PID:2388
-
\??\c:\rfllxrf.exec:\rfllxrf.exe72⤵PID:2456
-
\??\c:\nnntnt.exec:\nnntnt.exe73⤵PID:2440
-
\??\c:\bhhhtt.exec:\bhhhtt.exe74⤵PID:1064
-
\??\c:\dvvvd.exec:\dvvvd.exe75⤵PID:2524
-
\??\c:\lxllrrf.exec:\lxllrrf.exe76⤵PID:1188
-
\??\c:\5bnhnn.exec:\5bnhnn.exe77⤵PID:1740
-
\??\c:\ttnnnt.exec:\ttnnnt.exe78⤵PID:1704
-
\??\c:\ppdjp.exec:\ppdjp.exe79⤵PID:2188
-
\??\c:\djdpj.exec:\djdpj.exe80⤵PID:2680
-
\??\c:\lxrrrrx.exec:\lxrrrrx.exe81⤵PID:840
-
\??\c:\tnhnbh.exec:\tnhnbh.exe82⤵PID:1748
-
\??\c:\1pvvv.exec:\1pvvv.exe83⤵PID:2820
-
\??\c:\ppdjp.exec:\ppdjp.exe84⤵PID:2584
-
\??\c:\rrxlrfr.exec:\rrxlrfr.exe85⤵PID:2760
-
\??\c:\thbntt.exec:\thbntt.exe86⤵PID:2160
-
\??\c:\jjvdp.exec:\jjvdp.exe87⤵PID:2072
-
\??\c:\vvdjp.exec:\vvdjp.exe88⤵PID:2684
-
\??\c:\rfrxxxf.exec:\rfrxxxf.exe89⤵PID:2228
-
\??\c:\tttthn.exec:\tttthn.exe90⤵PID:1808
-
\??\c:\nbbbhb.exec:\nbbbhb.exe91⤵PID:1680
-
\??\c:\9vpdd.exec:\9vpdd.exe92⤵PID:2852
-
\??\c:\9flffxf.exec:\9flffxf.exe93⤵PID:2856
-
\??\c:\xxrxrfr.exec:\xxrxrfr.exe94⤵PID:2912
-
\??\c:\nnbthh.exec:\nnbthh.exe95⤵PID:2756
-
\??\c:\vddpv.exec:\vddpv.exe96⤵PID:1316
-
\??\c:\lrxxlxr.exec:\lrxxlxr.exe97⤵PID:2252
-
\??\c:\rlfflfr.exec:\rlfflfr.exe98⤵
- System Location Discovery: System Language Discovery
PID:1096 -
\??\c:\hhtbtt.exec:\hhtbtt.exe99⤵PID:480
-
\??\c:\ddvvj.exec:\ddvvj.exe100⤵PID:2140
-
\??\c:\5rxllxr.exec:\5rxllxr.exe101⤵PID:2112
-
\??\c:\bbthbn.exec:\bbthbn.exe102⤵PID:3024
-
\??\c:\pjvvv.exec:\pjvvv.exe103⤵PID:1056
-
\??\c:\vpvdj.exec:\vpvdj.exe104⤵PID:1308
-
\??\c:\xfflfrf.exec:\xfflfrf.exe105⤵PID:1604
-
\??\c:\thhntb.exec:\thhntb.exe106⤵PID:1488
-
\??\c:\9vpvj.exec:\9vpvj.exe107⤵PID:920
-
\??\c:\jjvjv.exec:\jjvjv.exe108⤵PID:2300
-
\??\c:\3fllxff.exec:\3fllxff.exe109⤵PID:3036
-
\??\c:\fxrxflf.exec:\fxrxflf.exe110⤵PID:876
-
\??\c:\hnhnbh.exec:\hnhnbh.exe111⤵PID:3060
-
\??\c:\jjvjv.exec:\jjvjv.exe112⤵PID:2520
-
\??\c:\5xrxffr.exec:\5xrxffr.exe113⤵PID:636
-
\??\c:\7bnbhn.exec:\7bnbhn.exe114⤵PID:2056
-
\??\c:\pppvd.exec:\pppvd.exe115⤵PID:1936
-
\??\c:\5rfrxff.exec:\5rfrxff.exe116⤵PID:1476
-
\??\c:\nnhtbb.exec:\nnhtbb.exe117⤵PID:2644
-
\??\c:\nthbnn.exec:\nthbnn.exe118⤵PID:348
-
\??\c:\pjvvd.exec:\pjvvd.exe119⤵PID:1776
-
\??\c:\lfrxlrf.exec:\lfrxlrf.exe120⤵PID:1688
-
\??\c:\llflxfr.exec:\llflxfr.exe121⤵PID:2692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-