Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 12:13
Behavioral task
behavioral1
Sample
8e2eb20149da338ff4e8e6effa4d312b5f92f1691b73733b2422b845c1c2fa2e.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
8e2eb20149da338ff4e8e6effa4d312b5f92f1691b73733b2422b845c1c2fa2e.exe
-
Size
335KB
-
MD5
91eabb4abe843a2b22a227c507e1ed48
-
SHA1
7dc8dc60a5fc92b89b600dfbaa2f4ce357ad33f7
-
SHA256
8e2eb20149da338ff4e8e6effa4d312b5f92f1691b73733b2422b845c1c2fa2e
-
SHA512
98472cf0c56b52836cf7f16f6b42c9c9227dd7977019b492db9af2788a7fedc445b686011783ce11ab2e69f69357ef14823678d034c63258feebcc1ed7d2adfb
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeRr:R4wFHoSHYHUrAwfMp3CDRr
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral1/memory/2956-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3024-29-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3024-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3024-33-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/308-39-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/308-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/308-43-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/764-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-85-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2800-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2380-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1696-147-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1728-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/464-163-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1968-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-177-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1968-181-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1320-189-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2620-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-198-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2428-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1816-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/740-231-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/740-230-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2172-268-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2172-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2092-278-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2196-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-302-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2180-318-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2824-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-355-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2836-376-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3000-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1356-388-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1088-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-398-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1608-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1428-464-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2432-470-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/292-487-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-493-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/552-504-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/284-516-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2172-552-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2292-558-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2984-565-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2500-566-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-603-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2736-602-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-609-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-630-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-646-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2384-688-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2036-782-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2268 9dvvd.exe 2964 7bttbh.exe 3024 3djpd.exe 308 lfllflx.exe 764 tnhhtt.exe 2736 hbnbhh.exe 2936 5jddj.exe 2816 5flfxrx.exe 2828 bthntb.exe 2800 xxlxlrf.exe 2592 nbnbhn.exe 3004 fxllxll.exe 3012 bhtbth.exe 316 rlrrxrf.exe 2380 rlxlrxl.exe 1696 dpvvv.exe 1728 rlfxffl.exe 464 5ntnnt.exe 2488 jddjv.exe 1968 htbhnn.exe 1320 nnnnbh.exe 2620 rfllrxf.exe 2428 9nhbhn.exe 1816 xxlxflx.exe 1216 bnhhnn.exe 740 btbttt.exe 592 fxrlxfl.exe 2680 dpvvj.exe 2340 pjjdj.exe 2464 tnbhnt.exe 2172 pppdp.exe 2092 frrllll.exe 2664 rlllxfl.exe 2196 pvjvd.exe 2076 5jppj.exe 2416 lfxxxfl.exe 2964 3tbhnn.exe 1592 7dppp.exe 2180 9pdvv.exe 540 rlfffff.exe 308 bntnnn.exe 2732 bntntt.exe 2824 5jvvd.exe 2712 1rrlfff.exe 2780 9lrlfff.exe 2872 btnbtb.exe 2604 htbbhb.exe 2828 vvppd.exe 2600 5lffllr.exe 2836 xrlfllx.exe 3000 thnbnh.exe 1356 jvvpv.exe 1088 pjpvd.exe 3012 lffxxxf.exe 1528 nhnhhb.exe 2020 bthhhh.exe 1692 5vjdj.exe 2404 7pdvv.exe 1608 xrfffll.exe 2364 3btntt.exe 1964 ntbttt.exe 1428 5vpjj.exe 1624 rrllrrr.exe 2876 1fllrrf.exe -
resource yara_rule behavioral1/memory/2956-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2268-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000012117-7.dat upx behavioral1/memory/2956-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2268-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016855-17.dat upx behavioral1/memory/3024-29-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/3024-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c62-25.dat upx behavioral1/memory/2964-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/308-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c84-35.dat upx behavioral1/memory/308-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cd1-44.dat upx behavioral1/memory/764-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cfc-52.dat upx behavioral1/memory/2736-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d25-61.dat upx behavioral1/memory/2936-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d36-68.dat upx behavioral1/memory/2816-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173fc-78.dat upx behavioral1/files/0x0006000000017472-89.dat upx behavioral1/memory/2800-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2800-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017487-96.dat upx behavioral1/memory/2592-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174a2-105.dat upx behavioral1/files/0x0006000000017525-115.dat upx behavioral1/memory/3004-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/316-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0014000000018663-125.dat upx behavioral1/memory/3012-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d00000001866e-132.dat upx behavioral1/memory/2380-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018687-139.dat upx behavioral1/files/0x0005000000018792-148.dat upx behavioral1/memory/1728-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000164c8-155.dat upx behavioral1/files/0x0006000000018c1a-164.dat upx behavioral1/memory/1968-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018c26-173.dat upx behavioral1/files/0x0006000000018f53-182.dat upx behavioral1/files/0x000600000001903b-190.dat upx behavioral1/memory/2620-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000190ce-199.dat upx behavioral1/memory/2428-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000190e0-207.dat upx behavioral1/files/0x00050000000191d4-216.dat upx behavioral1/memory/1816-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191ff-224.dat upx behavioral1/files/0x000500000001922c-232.dat upx behavioral1/files/0x0005000000019244-239.dat upx behavioral1/memory/2680-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019256-247.dat upx behavioral1/files/0x0005000000019259-254.dat upx behavioral1/files/0x0005000000019263-261.dat upx behavioral1/files/0x0005000000019266-269.dat upx behavioral1/memory/2172-270-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2196-290-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2824-339-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3000-382-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1088-395-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1692-418-0x0000000000220000-0x0000000000247000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nthht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7thhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2268 2956 8e2eb20149da338ff4e8e6effa4d312b5f92f1691b73733b2422b845c1c2fa2e.exe 30 PID 2956 wrote to memory of 2268 2956 8e2eb20149da338ff4e8e6effa4d312b5f92f1691b73733b2422b845c1c2fa2e.exe 30 PID 2956 wrote to memory of 2268 2956 8e2eb20149da338ff4e8e6effa4d312b5f92f1691b73733b2422b845c1c2fa2e.exe 30 PID 2956 wrote to memory of 2268 2956 8e2eb20149da338ff4e8e6effa4d312b5f92f1691b73733b2422b845c1c2fa2e.exe 30 PID 2268 wrote to memory of 2964 2268 9dvvd.exe 31 PID 2268 wrote to memory of 2964 2268 9dvvd.exe 31 PID 2268 wrote to memory of 2964 2268 9dvvd.exe 31 PID 2268 wrote to memory of 2964 2268 9dvvd.exe 31 PID 2964 wrote to memory of 3024 2964 7bttbh.exe 32 PID 2964 wrote to memory of 3024 2964 7bttbh.exe 32 PID 2964 wrote to memory of 3024 2964 7bttbh.exe 32 PID 2964 wrote to memory of 3024 2964 7bttbh.exe 32 PID 3024 wrote to memory of 308 3024 3djpd.exe 33 PID 3024 wrote to memory of 308 3024 3djpd.exe 33 PID 3024 wrote to memory of 308 3024 3djpd.exe 33 PID 3024 wrote to memory of 308 3024 3djpd.exe 33 PID 308 wrote to memory of 764 308 lfllflx.exe 34 PID 308 wrote to memory of 764 308 lfllflx.exe 34 PID 308 wrote to memory of 764 308 lfllflx.exe 34 PID 308 wrote to memory of 764 308 lfllflx.exe 34 PID 764 wrote to memory of 2736 764 tnhhtt.exe 35 PID 764 wrote to memory of 2736 764 tnhhtt.exe 35 PID 764 wrote to memory of 2736 764 tnhhtt.exe 35 PID 764 wrote to memory of 2736 764 tnhhtt.exe 35 PID 2736 wrote to memory of 2936 2736 hbnbhh.exe 36 PID 2736 wrote to memory of 2936 2736 hbnbhh.exe 36 PID 2736 wrote to memory of 2936 2736 hbnbhh.exe 36 PID 2736 wrote to memory of 2936 2736 hbnbhh.exe 36 PID 2936 wrote to memory of 2816 2936 5jddj.exe 37 PID 2936 wrote to memory of 2816 2936 5jddj.exe 37 PID 2936 wrote to memory of 2816 2936 5jddj.exe 37 PID 2936 wrote to memory of 2816 2936 5jddj.exe 37 PID 2816 wrote to memory of 2828 2816 5flfxrx.exe 38 PID 2816 wrote to memory of 2828 2816 5flfxrx.exe 38 PID 2816 wrote to memory of 2828 2816 5flfxrx.exe 38 PID 2816 wrote to memory of 2828 2816 5flfxrx.exe 38 PID 2828 wrote to memory of 2800 2828 bthntb.exe 39 PID 2828 wrote to memory of 2800 2828 bthntb.exe 39 PID 2828 wrote to memory of 2800 2828 bthntb.exe 39 PID 2828 wrote to memory of 2800 2828 bthntb.exe 39 PID 2800 wrote to memory of 2592 2800 xxlxlrf.exe 40 PID 2800 wrote to memory of 2592 2800 xxlxlrf.exe 40 PID 2800 wrote to memory of 2592 2800 xxlxlrf.exe 40 PID 2800 wrote to memory of 2592 2800 xxlxlrf.exe 40 PID 2592 wrote to memory of 3004 2592 nbnbhn.exe 41 PID 2592 wrote to memory of 3004 2592 nbnbhn.exe 41 PID 2592 wrote to memory of 3004 2592 nbnbhn.exe 41 PID 2592 wrote to memory of 3004 2592 nbnbhn.exe 41 PID 3004 wrote to memory of 3012 3004 fxllxll.exe 42 PID 3004 wrote to memory of 3012 3004 fxllxll.exe 42 PID 3004 wrote to memory of 3012 3004 fxllxll.exe 42 PID 3004 wrote to memory of 3012 3004 fxllxll.exe 42 PID 3012 wrote to memory of 316 3012 bhtbth.exe 43 PID 3012 wrote to memory of 316 3012 bhtbth.exe 43 PID 3012 wrote to memory of 316 3012 bhtbth.exe 43 PID 3012 wrote to memory of 316 3012 bhtbth.exe 43 PID 316 wrote to memory of 2380 316 rlrrxrf.exe 44 PID 316 wrote to memory of 2380 316 rlrrxrf.exe 44 PID 316 wrote to memory of 2380 316 rlrrxrf.exe 44 PID 316 wrote to memory of 2380 316 rlrrxrf.exe 44 PID 2380 wrote to memory of 1696 2380 rlxlrxl.exe 45 PID 2380 wrote to memory of 1696 2380 rlxlrxl.exe 45 PID 2380 wrote to memory of 1696 2380 rlxlrxl.exe 45 PID 2380 wrote to memory of 1696 2380 rlxlrxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e2eb20149da338ff4e8e6effa4d312b5f92f1691b73733b2422b845c1c2fa2e.exe"C:\Users\Admin\AppData\Local\Temp\8e2eb20149da338ff4e8e6effa4d312b5f92f1691b73733b2422b845c1c2fa2e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\9dvvd.exec:\9dvvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\7bttbh.exec:\7bttbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\3djpd.exec:\3djpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\lfllflx.exec:\lfllflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:308 -
\??\c:\tnhhtt.exec:\tnhhtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\hbnbhh.exec:\hbnbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\5jddj.exec:\5jddj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\5flfxrx.exec:\5flfxrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\bthntb.exec:\bthntb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\xxlxlrf.exec:\xxlxlrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\nbnbhn.exec:\nbnbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\fxllxll.exec:\fxllxll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\bhtbth.exec:\bhtbth.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\rlrrxrf.exec:\rlrrxrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\rlxlrxl.exec:\rlxlrxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\dpvvv.exec:\dpvvv.exe17⤵
- Executes dropped EXE
PID:1696 -
\??\c:\rlfxffl.exec:\rlfxffl.exe18⤵
- Executes dropped EXE
PID:1728 -
\??\c:\5ntnnt.exec:\5ntnnt.exe19⤵
- Executes dropped EXE
PID:464 -
\??\c:\jddjv.exec:\jddjv.exe20⤵
- Executes dropped EXE
PID:2488 -
\??\c:\htbhnn.exec:\htbhnn.exe21⤵
- Executes dropped EXE
PID:1968 -
\??\c:\nnnnbh.exec:\nnnnbh.exe22⤵
- Executes dropped EXE
PID:1320 -
\??\c:\rfllrxf.exec:\rfllrxf.exe23⤵
- Executes dropped EXE
PID:2620 -
\??\c:\9nhbhn.exec:\9nhbhn.exe24⤵
- Executes dropped EXE
PID:2428 -
\??\c:\xxlxflx.exec:\xxlxflx.exe25⤵
- Executes dropped EXE
PID:1816 -
\??\c:\bnhhnn.exec:\bnhhnn.exe26⤵
- Executes dropped EXE
PID:1216 -
\??\c:\btbttt.exec:\btbttt.exe27⤵
- Executes dropped EXE
PID:740 -
\??\c:\fxrlxfl.exec:\fxrlxfl.exe28⤵
- Executes dropped EXE
PID:592 -
\??\c:\dpvvj.exec:\dpvvj.exe29⤵
- Executes dropped EXE
PID:2680 -
\??\c:\pjjdj.exec:\pjjdj.exe30⤵
- Executes dropped EXE
PID:2340 -
\??\c:\tnbhnt.exec:\tnbhnt.exe31⤵
- Executes dropped EXE
PID:2464 -
\??\c:\pppdp.exec:\pppdp.exe32⤵
- Executes dropped EXE
PID:2172 -
\??\c:\frrllll.exec:\frrllll.exe33⤵
- Executes dropped EXE
PID:2092 -
\??\c:\rlllxfl.exec:\rlllxfl.exe34⤵
- Executes dropped EXE
PID:2664 -
\??\c:\pvjvd.exec:\pvjvd.exe35⤵
- Executes dropped EXE
PID:2196 -
\??\c:\5jppj.exec:\5jppj.exe36⤵
- Executes dropped EXE
PID:2076 -
\??\c:\lfxxxfl.exec:\lfxxxfl.exe37⤵
- Executes dropped EXE
PID:2416 -
\??\c:\3tbhnn.exec:\3tbhnn.exe38⤵
- Executes dropped EXE
PID:2964 -
\??\c:\7dppp.exec:\7dppp.exe39⤵
- Executes dropped EXE
PID:1592 -
\??\c:\9pdvv.exec:\9pdvv.exe40⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rlfffff.exec:\rlfffff.exe41⤵
- Executes dropped EXE
PID:540 -
\??\c:\bntnnn.exec:\bntnnn.exe42⤵
- Executes dropped EXE
PID:308 -
\??\c:\bntntt.exec:\bntntt.exe43⤵
- Executes dropped EXE
PID:2732 -
\??\c:\5jvvd.exec:\5jvvd.exe44⤵
- Executes dropped EXE
PID:2824 -
\??\c:\1rrlfff.exec:\1rrlfff.exe45⤵
- Executes dropped EXE
PID:2712 -
\??\c:\9lrlfff.exec:\9lrlfff.exe46⤵
- Executes dropped EXE
PID:2780 -
\??\c:\btnbtb.exec:\btnbtb.exe47⤵
- Executes dropped EXE
PID:2872 -
\??\c:\htbbhb.exec:\htbbhb.exe48⤵
- Executes dropped EXE
PID:2604 -
\??\c:\vvppd.exec:\vvppd.exe49⤵
- Executes dropped EXE
PID:2828 -
\??\c:\5lffllr.exec:\5lffllr.exe50⤵
- Executes dropped EXE
PID:2600 -
\??\c:\xrlfllx.exec:\xrlfllx.exe51⤵
- Executes dropped EXE
PID:2836 -
\??\c:\thnbnh.exec:\thnbnh.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3000 -
\??\c:\jvvpv.exec:\jvvpv.exe53⤵
- Executes dropped EXE
PID:1356 -
\??\c:\pjpvd.exec:\pjpvd.exe54⤵
- Executes dropped EXE
PID:1088 -
\??\c:\lffxxxf.exec:\lffxxxf.exe55⤵
- Executes dropped EXE
PID:3012 -
\??\c:\nhnhhb.exec:\nhnhhb.exe56⤵
- Executes dropped EXE
PID:1528 -
\??\c:\bthhhh.exec:\bthhhh.exe57⤵
- Executes dropped EXE
PID:2020 -
\??\c:\5vjdj.exec:\5vjdj.exe58⤵
- Executes dropped EXE
PID:1692 -
\??\c:\7pdvv.exec:\7pdvv.exe59⤵
- Executes dropped EXE
PID:2404 -
\??\c:\xrfffll.exec:\xrfffll.exe60⤵
- Executes dropped EXE
PID:1608 -
\??\c:\3btntt.exec:\3btntt.exe61⤵
- Executes dropped EXE
PID:2364 -
\??\c:\ntbttt.exec:\ntbttt.exe62⤵
- Executes dropped EXE
PID:1964 -
\??\c:\5vpjj.exec:\5vpjj.exe63⤵
- Executes dropped EXE
PID:1428 -
\??\c:\rrllrrr.exec:\rrllrrr.exe64⤵
- Executes dropped EXE
PID:1624 -
\??\c:\1fllrrf.exec:\1fllrrf.exe65⤵
- Executes dropped EXE
PID:2876 -
\??\c:\5bhttn.exec:\5bhttn.exe66⤵PID:2888
-
\??\c:\nhbntn.exec:\nhbntn.exe67⤵PID:2432
-
\??\c:\9jpjj.exec:\9jpjj.exe68⤵PID:2540
-
\??\c:\xrxrflr.exec:\xrxrflr.exe69⤵PID:444
-
\??\c:\thhbhh.exec:\thhbhh.exe70⤵PID:292
-
\??\c:\tthtbh.exec:\tthtbh.exe71⤵PID:296
-
\??\c:\vvpvj.exec:\vvpvj.exe72⤵PID:680
-
\??\c:\fxxxrlf.exec:\fxxxrlf.exe73⤵PID:552
-
\??\c:\frlxxrx.exec:\frlxxrx.exe74⤵PID:2188
-
\??\c:\nttnnn.exec:\nttnnn.exe75⤵PID:284
-
\??\c:\9vdvp.exec:\9vdvp.exe76⤵PID:2516
-
\??\c:\lrrfrfl.exec:\lrrfrfl.exe77⤵PID:2464
-
\??\c:\1lrfllx.exec:\1lrfllx.exe78⤵PID:1748
-
\??\c:\hbnntt.exec:\hbnntt.exe79⤵PID:2172
-
\??\c:\5httbb.exec:\5httbb.exe80⤵PID:2260
-
\??\c:\djvpd.exec:\djvpd.exe81⤵PID:2956
-
\??\c:\jvddd.exec:\jvddd.exe82⤵PID:2664
-
\??\c:\flxrxxx.exec:\flxrxxx.exe83⤵PID:2292
-
\??\c:\5tnhnt.exec:\5tnhnt.exe84⤵PID:2984
-
\??\c:\tbnnhh.exec:\tbnnhh.exe85⤵PID:2500
-
\??\c:\7dpjd.exec:\7dpjd.exe86⤵PID:2168
-
\??\c:\3rrrllx.exec:\3rrrllx.exe87⤵PID:3068
-
\??\c:\frxrrlr.exec:\frxrrlr.exe88⤵PID:2156
-
\??\c:\btbhtt.exec:\btbhtt.exe89⤵PID:1044
-
\??\c:\bnnhbb.exec:\bnnhbb.exe90⤵PID:2792
-
\??\c:\1ddvv.exec:\1ddvv.exe91⤵PID:2736
-
\??\c:\dpppv.exec:\dpppv.exe92⤵PID:2832
-
\??\c:\1xffffx.exec:\1xffffx.exe93⤵PID:2700
-
\??\c:\hbhhhb.exec:\hbhhhb.exe94⤵PID:3036
-
\??\c:\htbtht.exec:\htbtht.exe95⤵PID:2616
-
\??\c:\pdjdd.exec:\pdjdd.exe96⤵PID:2576
-
\??\c:\jppjd.exec:\jppjd.exe97⤵PID:2800
-
\??\c:\lxllxxx.exec:\lxllxxx.exe98⤵PID:2592
-
\??\c:\hbnntn.exec:\hbnntn.exe99⤵PID:2248
-
\??\c:\bnthhb.exec:\bnthhb.exe100⤵PID:828
-
\??\c:\vjppj.exec:\vjppj.exe101⤵PID:1656
-
\??\c:\1rrrlxx.exec:\1rrrlxx.exe102⤵PID:2012
-
\??\c:\fflfflx.exec:\fflfflx.exe103⤵PID:1388
-
\??\c:\tnbbbb.exec:\tnbbbb.exe104⤵PID:1884
-
\??\c:\httttn.exec:\httttn.exe105⤵PID:2124
-
\??\c:\pdjdv.exec:\pdjdv.exe106⤵PID:1692
-
\??\c:\9vjdj.exec:\9vjdj.exe107⤵PID:2384
-
\??\c:\3flllll.exec:\3flllll.exe108⤵PID:1184
-
\??\c:\nhttnh.exec:\nhttnh.exe109⤵PID:1412
-
\??\c:\tbbttn.exec:\tbbttn.exe110⤵PID:2488
-
\??\c:\jvdvp.exec:\jvdvp.exe111⤵PID:544
-
\??\c:\5pdvv.exec:\5pdvv.exe112⤵PID:1760
-
\??\c:\rflxxxl.exec:\rflxxxl.exe113⤵PID:1320
-
\??\c:\rflflll.exec:\rflflll.exe114⤵PID:2424
-
\??\c:\7bhbhh.exec:\7bhbhh.exe115⤵PID:2856
-
\??\c:\7vjjj.exec:\7vjjj.exe116⤵PID:2432
-
\??\c:\7jvjd.exec:\7jvjd.exe117⤵PID:2540
-
\??\c:\xlrllfx.exec:\xlrllfx.exe118⤵PID:2148
-
\??\c:\bhnhbt.exec:\bhnhbt.exe119⤵PID:1520
-
\??\c:\tntttn.exec:\tntttn.exe120⤵PID:296
-
\??\c:\pjvjp.exec:\pjvjp.exe121⤵PID:680
-
\??\c:\vdddd.exec:\vdddd.exe122⤵PID:2544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-