Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 13:46
Behavioral task
behavioral1
Sample
07fa7c8a926bf844880fc48705f069def0417749037859747319d692a8f15d45.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
07fa7c8a926bf844880fc48705f069def0417749037859747319d692a8f15d45.exe
-
Size
334KB
-
MD5
bebbac8ee4ed9d02b8b9e983dced4987
-
SHA1
49f1e18995c51a47f526c31a4675087d7e6054cc
-
SHA256
07fa7c8a926bf844880fc48705f069def0417749037859747319d692a8f15d45
-
SHA512
572aef0b2115b8eb9bf29b383712fc56a97ba19671728f9af1ef86513112f97074f4cb397786a63303fffae784d8477e855b4dddf9e41bc7619f5ee6939bc873
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeRe:R4wFHoSHYHUrAwfMp3CDRe
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2416-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-22-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2908-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1660-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2400-103-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1316-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2316-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/536-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2788-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/860-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1004-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/904-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-295-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2848-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-337-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2660-350-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2572-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1204-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1788-405-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2012-422-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1524-431-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2096-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2376-445-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/920-464-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-477-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1464-486-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2352-507-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1396-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1888-526-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2336-545-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2900-800-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-809-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2168 frffrrf.exe 2908 hhtnbb.exe 2724 fxfxxrf.exe 3008 7hbnhh.exe 2804 djvpv.exe 2744 nntnnt.exe 2720 pdjjp.exe 2812 1frflrf.exe 2960 thbbnn.exe 2544 ppddd.exe 2616 5frfrlx.exe 2400 hhtbnn.exe 1660 7jvvv.exe 1788 3pjjp.exe 2328 3thnnt.exe 1856 ppjvd.exe 1316 rfxfffl.exe 2316 3thntt.exe 2012 jjdpj.exe 536 dvjpv.exe 2788 rlxffxf.exe 2196 thnbbn.exe 2612 3vvpv.exe 2856 3fflxff.exe 860 hbnttb.exe 1480 pvvdj.exe 1464 bhbtbh.exe 3052 nnhbbn.exe 2816 jddpv.exe 1004 ffxxlrf.exe 2832 tthbbh.exe 904 vvpdj.exe 1348 ffxffrf.exe 2416 bthhtb.exe 1544 btbhhn.exe 2168 vpvdj.exe 2892 xxflrlf.exe 2908 ffrxllr.exe 2424 tnbbhh.exe 2652 pjdjp.exe 2848 jdjdd.exe 2796 7lrxfrx.exe 2744 bnbnbh.exe 2720 3bnttt.exe 2784 1jddj.exe 2660 xxxfrxf.exe 2572 rrfflrf.exe 2456 thbttn.exe 2620 7bnhbh.exe 2000 pvpdj.exe 2320 xlxxxxf.exe 2368 xrllrrx.exe 1788 nhtnhh.exe 1204 1jvpp.exe 2504 vjpvj.exe 1748 lfxfrrf.exe 1932 thnttb.exe 2316 3hnnbh.exe 2012 jvvdj.exe 1524 rrlxrxl.exe 2096 flfrxxl.exe 1784 7hbtbb.exe 2376 dvpjp.exe 1292 djdpv.exe -
resource yara_rule behavioral1/memory/2416-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000e000000013a51-5.dat upx behavioral1/memory/2416-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186f2-15.dat upx behavioral1/memory/2168-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2908-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186f8-23.dat upx behavioral1/memory/2724-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018731-32.dat upx behavioral1/files/0x0006000000018742-39.dat upx behavioral1/memory/2804-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3008-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2804-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001878c-49.dat upx behavioral1/files/0x0007000000018bf3-56.dat upx behavioral1/memory/2744-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2720-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000019438-65.dat upx behavioral1/files/0x0005000000019456-72.dat upx behavioral1/memory/2812-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001945c-80.dat upx behavioral1/memory/2544-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019467-88.dat upx behavioral1/files/0x0005000000019496-96.dat upx behavioral1/files/0x00050000000194ad-104.dat upx behavioral1/memory/1660-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194d0-112.dat upx behavioral1/files/0x00050000000194ef-120.dat upx behavioral1/memory/2328-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194fc-128.dat upx behavioral1/files/0x0005000000019506-136.dat upx behavioral1/memory/1316-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001952f-143.dat upx behavioral1/memory/2316-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001957e-151.dat upx behavioral1/files/0x00050000000195a7-159.dat upx behavioral1/files/0x00050000000195e6-168.dat upx behavioral1/memory/536-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2788-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961d-177.dat upx behavioral1/memory/2196-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x001700000001866f-186.dat upx behavioral1/memory/2856-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961f-192.dat upx behavioral1/files/0x0005000000019621-201.dat upx behavioral1/files/0x0005000000019622-209.dat upx behavioral1/memory/860-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019623-216.dat upx behavioral1/memory/3052-224-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019625-223.dat upx behavioral1/files/0x0005000000019627-234.dat upx behavioral1/memory/2816-235-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3052-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019629-241.dat upx behavioral1/files/0x000500000001962b-251.dat upx behavioral1/memory/2832-253-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1004-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001963b-259.dat upx behavioral1/memory/904-266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2848-320-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2572-351-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2368-386-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1204-397-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1932-411-0x0000000000220000-0x0000000000247000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2168 2416 07fa7c8a926bf844880fc48705f069def0417749037859747319d692a8f15d45.exe 31 PID 2416 wrote to memory of 2168 2416 07fa7c8a926bf844880fc48705f069def0417749037859747319d692a8f15d45.exe 31 PID 2416 wrote to memory of 2168 2416 07fa7c8a926bf844880fc48705f069def0417749037859747319d692a8f15d45.exe 31 PID 2416 wrote to memory of 2168 2416 07fa7c8a926bf844880fc48705f069def0417749037859747319d692a8f15d45.exe 31 PID 2168 wrote to memory of 2908 2168 frffrrf.exe 32 PID 2168 wrote to memory of 2908 2168 frffrrf.exe 32 PID 2168 wrote to memory of 2908 2168 frffrrf.exe 32 PID 2168 wrote to memory of 2908 2168 frffrrf.exe 32 PID 2908 wrote to memory of 2724 2908 hhtnbb.exe 33 PID 2908 wrote to memory of 2724 2908 hhtnbb.exe 33 PID 2908 wrote to memory of 2724 2908 hhtnbb.exe 33 PID 2908 wrote to memory of 2724 2908 hhtnbb.exe 33 PID 2724 wrote to memory of 3008 2724 fxfxxrf.exe 34 PID 2724 wrote to memory of 3008 2724 fxfxxrf.exe 34 PID 2724 wrote to memory of 3008 2724 fxfxxrf.exe 34 PID 2724 wrote to memory of 3008 2724 fxfxxrf.exe 34 PID 3008 wrote to memory of 2804 3008 7hbnhh.exe 35 PID 3008 wrote to memory of 2804 3008 7hbnhh.exe 35 PID 3008 wrote to memory of 2804 3008 7hbnhh.exe 35 PID 3008 wrote to memory of 2804 3008 7hbnhh.exe 35 PID 2804 wrote to memory of 2744 2804 djvpv.exe 36 PID 2804 wrote to memory of 2744 2804 djvpv.exe 36 PID 2804 wrote to memory of 2744 2804 djvpv.exe 36 PID 2804 wrote to memory of 2744 2804 djvpv.exe 36 PID 2744 wrote to memory of 2720 2744 nntnnt.exe 37 PID 2744 wrote to memory of 2720 2744 nntnnt.exe 37 PID 2744 wrote to memory of 2720 2744 nntnnt.exe 37 PID 2744 wrote to memory of 2720 2744 nntnnt.exe 37 PID 2720 wrote to memory of 2812 2720 pdjjp.exe 38 PID 2720 wrote to memory of 2812 2720 pdjjp.exe 38 PID 2720 wrote to memory of 2812 2720 pdjjp.exe 38 PID 2720 wrote to memory of 2812 2720 pdjjp.exe 38 PID 2812 wrote to memory of 2960 2812 1frflrf.exe 39 PID 2812 wrote to memory of 2960 2812 1frflrf.exe 39 PID 2812 wrote to memory of 2960 2812 1frflrf.exe 39 PID 2812 wrote to memory of 2960 2812 1frflrf.exe 39 PID 2960 wrote to memory of 2544 2960 thbbnn.exe 40 PID 2960 wrote to memory of 2544 2960 thbbnn.exe 40 PID 2960 wrote to memory of 2544 2960 thbbnn.exe 40 PID 2960 wrote to memory of 2544 2960 thbbnn.exe 40 PID 2544 wrote to memory of 2616 2544 ppddd.exe 41 PID 2544 wrote to memory of 2616 2544 ppddd.exe 41 PID 2544 wrote to memory of 2616 2544 ppddd.exe 41 PID 2544 wrote to memory of 2616 2544 ppddd.exe 41 PID 2616 wrote to memory of 2400 2616 5frfrlx.exe 42 PID 2616 wrote to memory of 2400 2616 5frfrlx.exe 42 PID 2616 wrote to memory of 2400 2616 5frfrlx.exe 42 PID 2616 wrote to memory of 2400 2616 5frfrlx.exe 42 PID 2400 wrote to memory of 1660 2400 hhtbnn.exe 43 PID 2400 wrote to memory of 1660 2400 hhtbnn.exe 43 PID 2400 wrote to memory of 1660 2400 hhtbnn.exe 43 PID 2400 wrote to memory of 1660 2400 hhtbnn.exe 43 PID 1660 wrote to memory of 1788 1660 7jvvv.exe 44 PID 1660 wrote to memory of 1788 1660 7jvvv.exe 44 PID 1660 wrote to memory of 1788 1660 7jvvv.exe 44 PID 1660 wrote to memory of 1788 1660 7jvvv.exe 44 PID 1788 wrote to memory of 2328 1788 3pjjp.exe 45 PID 1788 wrote to memory of 2328 1788 3pjjp.exe 45 PID 1788 wrote to memory of 2328 1788 3pjjp.exe 45 PID 1788 wrote to memory of 2328 1788 3pjjp.exe 45 PID 2328 wrote to memory of 1856 2328 3thnnt.exe 46 PID 2328 wrote to memory of 1856 2328 3thnnt.exe 46 PID 2328 wrote to memory of 1856 2328 3thnnt.exe 46 PID 2328 wrote to memory of 1856 2328 3thnnt.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\07fa7c8a926bf844880fc48705f069def0417749037859747319d692a8f15d45.exe"C:\Users\Admin\AppData\Local\Temp\07fa7c8a926bf844880fc48705f069def0417749037859747319d692a8f15d45.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\frffrrf.exec:\frffrrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\hhtnbb.exec:\hhtnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\fxfxxrf.exec:\fxfxxrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\7hbnhh.exec:\7hbnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\djvpv.exec:\djvpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\nntnnt.exec:\nntnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\pdjjp.exec:\pdjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\1frflrf.exec:\1frflrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\thbbnn.exec:\thbbnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\ppddd.exec:\ppddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\5frfrlx.exec:\5frfrlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\hhtbnn.exec:\hhtbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\7jvvv.exec:\7jvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\3pjjp.exec:\3pjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\3thnnt.exec:\3thnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\ppjvd.exec:\ppjvd.exe17⤵
- Executes dropped EXE
PID:1856 -
\??\c:\rfxfffl.exec:\rfxfffl.exe18⤵
- Executes dropped EXE
PID:1316 -
\??\c:\3thntt.exec:\3thntt.exe19⤵
- Executes dropped EXE
PID:2316 -
\??\c:\jjdpj.exec:\jjdpj.exe20⤵
- Executes dropped EXE
PID:2012 -
\??\c:\dvjpv.exec:\dvjpv.exe21⤵
- Executes dropped EXE
PID:536 -
\??\c:\rlxffxf.exec:\rlxffxf.exe22⤵
- Executes dropped EXE
PID:2788 -
\??\c:\thnbbn.exec:\thnbbn.exe23⤵
- Executes dropped EXE
PID:2196 -
\??\c:\3vvpv.exec:\3vvpv.exe24⤵
- Executes dropped EXE
PID:2612 -
\??\c:\3fflxff.exec:\3fflxff.exe25⤵
- Executes dropped EXE
PID:2856 -
\??\c:\hbnttb.exec:\hbnttb.exe26⤵
- Executes dropped EXE
PID:860 -
\??\c:\pvvdj.exec:\pvvdj.exe27⤵
- Executes dropped EXE
PID:1480 -
\??\c:\bhbtbh.exec:\bhbtbh.exe28⤵
- Executes dropped EXE
PID:1464 -
\??\c:\nnhbbn.exec:\nnhbbn.exe29⤵
- Executes dropped EXE
PID:3052 -
\??\c:\jddpv.exec:\jddpv.exe30⤵
- Executes dropped EXE
PID:2816 -
\??\c:\ffxxlrf.exec:\ffxxlrf.exe31⤵
- Executes dropped EXE
PID:1004 -
\??\c:\tthbbh.exec:\tthbbh.exe32⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vvpdj.exec:\vvpdj.exe33⤵
- Executes dropped EXE
PID:904 -
\??\c:\ffxffrf.exec:\ffxffrf.exe34⤵
- Executes dropped EXE
PID:1348 -
\??\c:\bthhtb.exec:\bthhtb.exe35⤵
- Executes dropped EXE
PID:2416 -
\??\c:\btbhhn.exec:\btbhhn.exe36⤵
- Executes dropped EXE
PID:1544 -
\??\c:\vpvdj.exec:\vpvdj.exe37⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xxflrlf.exec:\xxflrlf.exe38⤵
- Executes dropped EXE
PID:2892 -
\??\c:\ffrxllr.exec:\ffrxllr.exe39⤵
- Executes dropped EXE
PID:2908 -
\??\c:\tnbbhh.exec:\tnbbhh.exe40⤵
- Executes dropped EXE
PID:2424 -
\??\c:\pjdjp.exec:\pjdjp.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2652 -
\??\c:\jdjdd.exec:\jdjdd.exe42⤵
- Executes dropped EXE
PID:2848 -
\??\c:\7lrxfrx.exec:\7lrxfrx.exe43⤵
- Executes dropped EXE
PID:2796 -
\??\c:\bnbnbh.exec:\bnbnbh.exe44⤵
- Executes dropped EXE
PID:2744 -
\??\c:\3bnttt.exec:\3bnttt.exe45⤵
- Executes dropped EXE
PID:2720 -
\??\c:\1jddj.exec:\1jddj.exe46⤵
- Executes dropped EXE
PID:2784 -
\??\c:\xxxfrxf.exec:\xxxfrxf.exe47⤵
- Executes dropped EXE
PID:2660 -
\??\c:\rrfflrf.exec:\rrfflrf.exe48⤵
- Executes dropped EXE
PID:2572 -
\??\c:\thbttn.exec:\thbttn.exe49⤵
- Executes dropped EXE
PID:2456 -
\??\c:\7bnhbh.exec:\7bnhbh.exe50⤵
- Executes dropped EXE
PID:2620 -
\??\c:\pvpdj.exec:\pvpdj.exe51⤵
- Executes dropped EXE
PID:2000 -
\??\c:\xlxxxxf.exec:\xlxxxxf.exe52⤵
- Executes dropped EXE
PID:2320 -
\??\c:\xrllrrx.exec:\xrllrrx.exe53⤵
- Executes dropped EXE
PID:2368 -
\??\c:\nhtnhh.exec:\nhtnhh.exe54⤵
- Executes dropped EXE
PID:1788 -
\??\c:\1jvpp.exec:\1jvpp.exe55⤵
- Executes dropped EXE
PID:1204 -
\??\c:\vjpvj.exec:\vjpvj.exe56⤵
- Executes dropped EXE
PID:2504 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe57⤵
- Executes dropped EXE
PID:1748 -
\??\c:\thnttb.exec:\thnttb.exe58⤵
- Executes dropped EXE
PID:1932 -
\??\c:\3hnnbh.exec:\3hnnbh.exe59⤵
- Executes dropped EXE
PID:2316 -
\??\c:\jvvdj.exec:\jvvdj.exe60⤵
- Executes dropped EXE
PID:2012 -
\??\c:\rrlxrxl.exec:\rrlxrxl.exe61⤵
- Executes dropped EXE
PID:1524 -
\??\c:\flfrxxl.exec:\flfrxxl.exe62⤵
- Executes dropped EXE
PID:2096 -
\??\c:\7hbtbb.exec:\7hbtbb.exe63⤵
- Executes dropped EXE
PID:1784 -
\??\c:\dvpjp.exec:\dvpjp.exe64⤵
- Executes dropped EXE
PID:2376 -
\??\c:\djdpv.exec:\djdpv.exe65⤵
- Executes dropped EXE
PID:1292 -
\??\c:\5xlrrrf.exec:\5xlrrrf.exe66⤵PID:1668
-
\??\c:\nhttnt.exec:\nhttnt.exe67⤵PID:920
-
\??\c:\tthhnh.exec:\tthhnh.exe68⤵PID:972
-
\??\c:\5dvdj.exec:\5dvdj.exe69⤵PID:2260
-
\??\c:\pdppv.exec:\pdppv.exe70⤵PID:2868
-
\??\c:\rlflrfl.exec:\rlflrfl.exe71⤵PID:1464
-
\??\c:\nnnbhn.exec:\nnnbhn.exe72⤵PID:2476
-
\??\c:\5htttt.exec:\5htttt.exe73⤵PID:2076
-
\??\c:\jjddj.exec:\jjddj.exe74⤵PID:1720
-
\??\c:\1vvpd.exec:\1vvpd.exe75⤵PID:2352
-
\??\c:\3frllfr.exec:\3frllfr.exe76⤵PID:696
-
\??\c:\hbnbbb.exec:\hbnbbb.exe77⤵PID:1396
-
\??\c:\7tnhtt.exec:\7tnhtt.exe78⤵PID:1888
-
\??\c:\vpddd.exec:\vpddd.exe79⤵PID:2132
-
\??\c:\pdpvd.exec:\pdpvd.exe80⤵PID:1644
-
\??\c:\llfxrrx.exec:\llfxrrx.exe81⤵PID:1840
-
\??\c:\hbtbhb.exec:\hbtbhb.exe82⤵PID:2336
-
\??\c:\nnhhnn.exec:\nnhhnn.exe83⤵PID:2912
-
\??\c:\pjddd.exec:\pjddd.exe84⤵PID:824
-
\??\c:\1pvdj.exec:\1pvdj.exe85⤵PID:2380
-
\??\c:\lxlrxxr.exec:\lxlrxxr.exe86⤵PID:3012
-
\??\c:\btnhtt.exec:\btnhtt.exe87⤵PID:2804
-
\??\c:\7nhntt.exec:\7nhntt.exe88⤵PID:2852
-
\??\c:\5pdvj.exec:\5pdvj.exe89⤵PID:2740
-
\??\c:\9pppp.exec:\9pppp.exe90⤵PID:2568
-
\??\c:\rlxflrl.exec:\rlxflrl.exe91⤵PID:2684
-
\??\c:\bthhbn.exec:\bthhbn.exe92⤵PID:2536
-
\??\c:\nbttnt.exec:\nbttnt.exe93⤵PID:2960
-
\??\c:\9dpvd.exec:\9dpvd.exe94⤵PID:2572
-
\??\c:\jjvdj.exec:\jjvdj.exe95⤵PID:2916
-
\??\c:\rrlrxrf.exec:\rrlrxrf.exe96⤵PID:648
-
\??\c:\5lrfrxl.exec:\5lrfrxl.exe97⤵PID:236
-
\??\c:\nhbbhn.exec:\nhbbhn.exe98⤵PID:1048
-
\??\c:\jdddp.exec:\jdddp.exe99⤵PID:592
-
\??\c:\1jdvj.exec:\1jdvj.exe100⤵PID:900
-
\??\c:\xxlrllx.exec:\xxlrllx.exe101⤵PID:2268
-
\??\c:\1llrxxl.exec:\1llrxxl.exe102⤵PID:1856
-
\??\c:\nhbhnn.exec:\nhbhnn.exe103⤵PID:1636
-
\??\c:\nnthhh.exec:\nnthhh.exe104⤵PID:1880
-
\??\c:\9jvdj.exec:\9jvdj.exe105⤵PID:1692
-
\??\c:\ffflxff.exec:\ffflxff.exe106⤵PID:1572
-
\??\c:\frflxrx.exec:\frflxrx.exe107⤵PID:536
-
\??\c:\btnntb.exec:\btnntb.exe108⤵PID:2788
-
\??\c:\nnhthn.exec:\nnhthn.exe109⤵PID:2580
-
\??\c:\jjjpv.exec:\jjjpv.exe110⤵PID:2372
-
\??\c:\ppjjv.exec:\ppjjv.exe111⤵PID:3036
-
\??\c:\llxlxlf.exec:\llxlxlf.exe112⤵PID:932
-
\??\c:\xxrxlrx.exec:\xxrxlrx.exe113⤵PID:2856
-
\??\c:\thnntt.exec:\thnntt.exe114⤵PID:920
-
\??\c:\1nntnb.exec:\1nntnb.exe115⤵PID:972
-
\??\c:\vppdj.exec:\vppdj.exe116⤵PID:2260
-
\??\c:\xxffxlx.exec:\xxffxlx.exe117⤵PID:2868
-
\??\c:\1lfxfrx.exec:\1lfxfrx.exe118⤵PID:1464
-
\??\c:\tnbhnn.exec:\tnbhnn.exe119⤵PID:2840
-
\??\c:\7btbhh.exec:\7btbhh.exe120⤵PID:3000
-
\??\c:\jvjjd.exec:\jvjjd.exe121⤵PID:1004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-