Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 22:22
Behavioral task
behavioral1
Sample
8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe
-
Size
79KB
-
MD5
cb863cf8e93ff7a43298f94c189444f3
-
SHA1
3588f9310b77dbf1090386779171d43b3650f89e
-
SHA256
8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3
-
SHA512
449141698b3ab7120a47c017e3c2c91b2df0874e0916db01ac9fd6c123684116006c8112987981807f664c2298e00ed911efddd0c8dc047bb03804d120221841
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w1rCJtzx8/p7ke2B:xhOmTsF93UYfwC6GIout03LzGFE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/1964-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2356-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-82-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2652-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2096-71-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2612-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/996-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1128-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1704-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1348-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/556-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/680-220-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1620-247-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/1620-246-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/1968-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/900-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1956-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-331-0x0000000076C40000-0x0000000076D5F000-memory.dmp family_blackmoon behavioral1/memory/2964-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1448-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/676-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1720-476-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/644-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/948-510-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-631-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2504-759-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/408-765-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2104-791-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/976-801-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-881-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1132-943-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2156-997-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/348-1024-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1308-1050-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1620-1071-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1620-1070-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1932-1102-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2352-1134-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2864-1166-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2624-1192-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2136-1206-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2360-1225-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1688-1271-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2696 ppvjv.exe 2056 9fxfxrf.exe 2356 lxrffll.exe 2716 nhbbhh.exe 2892 btbbbb.exe 2736 9ppdp.exe 2096 pjvjv.exe 2652 bnhnnh.exe 2612 dddjv.exe 996 dpjjp.exe 1708 llfllxl.exe 1128 rlxflxf.exe 1248 hhhtbn.exe 1732 fxffllx.exe 2916 rrxrxxf.exe 2600 btnbnt.exe 1704 ntntbh.exe 1348 5xrllrx.exe 2488 fxrfffl.exe 556 5tntbb.exe 608 hbbbbb.exe 3020 3pjjp.exe 680 5flxfrf.exe 2584 9hntbb.exe 1916 hbntbh.exe 1620 hbbbhh.exe 2348 vvjjp.exe 1456 3jjdp.exe 1256 xxfflfr.exe 1972 xrlxxxl.exe 868 vjvvp.exe 1968 9jjjd.exe 900 llflxfx.exe 1956 bbtbhb.exe 2428 7btbnb.exe 2052 ppdjp.exe 2764 1fllxxl.exe 3032 7rrfffr.exe 2864 bnnbhb.exe 2640 9lllrxl.exe 2964 rrflllx.exe 2660 1nbtbn.exe 2860 hhhttb.exe 2616 jdpjv.exe 1448 jjppv.exe 2300 jpvjp.exe 676 7fxlxfx.exe 2812 tnhnth.exe 2920 3thhbn.exe 1888 1ddpp.exe 2000 jjjjd.exe 2932 lfrxfll.exe 2016 9lfxllf.exe 2148 tntthh.exe 1876 3ntbnn.exe 1812 hhbbhn.exe 684 jpjpv.exe 380 dddjd.exe 1720 xxlrrfr.exe 2128 xxflrxr.exe 644 bbbntb.exe 824 1hthhb.exe 1952 pjvdj.exe 948 rrffrxx.exe -
resource yara_rule behavioral1/memory/1964-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012117-10.dat upx behavioral1/memory/2696-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1964-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d0e-18.dat upx behavioral1/memory/2696-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d21-37.dat upx behavioral1/memory/2356-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d18-28.dat upx behavioral1/memory/2716-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d31-45.dat upx behavioral1/memory/2892-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2056-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d3a-56.dat upx behavioral1/memory/2892-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d42-63.dat upx behavioral1/files/0x0005000000018683-81.dat upx behavioral1/memory/2652-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d5e-73.dat upx behavioral1/files/0x00050000000186e4-93.dat upx behavioral1/memory/2612-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186ea-102.dat upx behavioral1/memory/996-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186fd-118.dat upx behavioral1/memory/1128-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186ee-110.dat upx behavioral1/files/0x0005000000018728-126.dat upx behavioral1/memory/1732-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1732-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001873d-135.dat upx behavioral1/files/0x0005000000018784-148.dat upx behavioral1/memory/2600-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2916-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001878f-156.dat upx behavioral1/memory/2600-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000187a5-164.dat upx behavioral1/memory/1348-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1704-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019023-175.dat upx behavioral1/memory/1348-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001925e-186.dat upx behavioral1/memory/556-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019261-194.dat upx behavioral1/memory/556-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019282-202.dat upx behavioral1/memory/3020-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019334-211.dat upx behavioral1/files/0x0005000000019350-222.dat upx behavioral1/memory/680-220-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00050000000193b4-230.dat upx behavioral1/memory/1620-238-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193e1-245.dat upx behavioral1/files/0x00050000000193c2-239.dat upx behavioral1/files/0x000500000001941e-256.dat upx behavioral1/files/0x0005000000019427-264.dat upx behavioral1/files/0x0005000000019431-272.dat upx behavioral1/memory/1972-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019441-280.dat upx behavioral1/files/0x000500000001944f-289.dat upx behavioral1/memory/1968-298-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/900-304-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1956-311-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3032-333-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3032-331-0x0000000076C40000-0x0000000076D5F000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlffxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2696 1964 8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe 30 PID 1964 wrote to memory of 2696 1964 8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe 30 PID 1964 wrote to memory of 2696 1964 8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe 30 PID 1964 wrote to memory of 2696 1964 8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe 30 PID 2696 wrote to memory of 2056 2696 ppvjv.exe 31 PID 2696 wrote to memory of 2056 2696 ppvjv.exe 31 PID 2696 wrote to memory of 2056 2696 ppvjv.exe 31 PID 2696 wrote to memory of 2056 2696 ppvjv.exe 31 PID 2056 wrote to memory of 2356 2056 9fxfxrf.exe 32 PID 2056 wrote to memory of 2356 2056 9fxfxrf.exe 32 PID 2056 wrote to memory of 2356 2056 9fxfxrf.exe 32 PID 2056 wrote to memory of 2356 2056 9fxfxrf.exe 32 PID 2356 wrote to memory of 2716 2356 lxrffll.exe 33 PID 2356 wrote to memory of 2716 2356 lxrffll.exe 33 PID 2356 wrote to memory of 2716 2356 lxrffll.exe 33 PID 2356 wrote to memory of 2716 2356 lxrffll.exe 33 PID 2716 wrote to memory of 2892 2716 nhbbhh.exe 34 PID 2716 wrote to memory of 2892 2716 nhbbhh.exe 34 PID 2716 wrote to memory of 2892 2716 nhbbhh.exe 34 PID 2716 wrote to memory of 2892 2716 nhbbhh.exe 34 PID 2892 wrote to memory of 2736 2892 btbbbb.exe 35 PID 2892 wrote to memory of 2736 2892 btbbbb.exe 35 PID 2892 wrote to memory of 2736 2892 btbbbb.exe 35 PID 2892 wrote to memory of 2736 2892 btbbbb.exe 35 PID 2736 wrote to memory of 2096 2736 9ppdp.exe 36 PID 2736 wrote to memory of 2096 2736 9ppdp.exe 36 PID 2736 wrote to memory of 2096 2736 9ppdp.exe 36 PID 2736 wrote to memory of 2096 2736 9ppdp.exe 36 PID 2096 wrote to memory of 2652 2096 pjvjv.exe 37 PID 2096 wrote to memory of 2652 2096 pjvjv.exe 37 PID 2096 wrote to memory of 2652 2096 pjvjv.exe 37 PID 2096 wrote to memory of 2652 2096 pjvjv.exe 37 PID 2652 wrote to memory of 2612 2652 bnhnnh.exe 38 PID 2652 wrote to memory of 2612 2652 bnhnnh.exe 38 PID 2652 wrote to memory of 2612 2652 bnhnnh.exe 38 PID 2652 wrote to memory of 2612 2652 bnhnnh.exe 38 PID 2612 wrote to memory of 996 2612 dddjv.exe 39 PID 2612 wrote to memory of 996 2612 dddjv.exe 39 PID 2612 wrote to memory of 996 2612 dddjv.exe 39 PID 2612 wrote to memory of 996 2612 dddjv.exe 39 PID 996 wrote to memory of 1708 996 dpjjp.exe 40 PID 996 wrote to memory of 1708 996 dpjjp.exe 40 PID 996 wrote to memory of 1708 996 dpjjp.exe 40 PID 996 wrote to memory of 1708 996 dpjjp.exe 40 PID 1708 wrote to memory of 1128 1708 llfllxl.exe 41 PID 1708 wrote to memory of 1128 1708 llfllxl.exe 41 PID 1708 wrote to memory of 1128 1708 llfllxl.exe 41 PID 1708 wrote to memory of 1128 1708 llfllxl.exe 41 PID 1128 wrote to memory of 1248 1128 rlxflxf.exe 42 PID 1128 wrote to memory of 1248 1128 rlxflxf.exe 42 PID 1128 wrote to memory of 1248 1128 rlxflxf.exe 42 PID 1128 wrote to memory of 1248 1128 rlxflxf.exe 42 PID 1248 wrote to memory of 1732 1248 hhhtbn.exe 43 PID 1248 wrote to memory of 1732 1248 hhhtbn.exe 43 PID 1248 wrote to memory of 1732 1248 hhhtbn.exe 43 PID 1248 wrote to memory of 1732 1248 hhhtbn.exe 43 PID 1732 wrote to memory of 2916 1732 fxffllx.exe 44 PID 1732 wrote to memory of 2916 1732 fxffllx.exe 44 PID 1732 wrote to memory of 2916 1732 fxffllx.exe 44 PID 1732 wrote to memory of 2916 1732 fxffllx.exe 44 PID 2916 wrote to memory of 2600 2916 rrxrxxf.exe 45 PID 2916 wrote to memory of 2600 2916 rrxrxxf.exe 45 PID 2916 wrote to memory of 2600 2916 rrxrxxf.exe 45 PID 2916 wrote to memory of 2600 2916 rrxrxxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe"C:\Users\Admin\AppData\Local\Temp\8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\ppvjv.exec:\ppvjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\9fxfxrf.exec:\9fxfxrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\lxrffll.exec:\lxrffll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\nhbbhh.exec:\nhbbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\btbbbb.exec:\btbbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\9ppdp.exec:\9ppdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\pjvjv.exec:\pjvjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\bnhnnh.exec:\bnhnnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\dddjv.exec:\dddjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\dpjjp.exec:\dpjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\llfllxl.exec:\llfllxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\rlxflxf.exec:\rlxflxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\hhhtbn.exec:\hhhtbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\fxffllx.exec:\fxffllx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\rrxrxxf.exec:\rrxrxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\btnbnt.exec:\btnbnt.exe17⤵
- Executes dropped EXE
PID:2600 -
\??\c:\ntntbh.exec:\ntntbh.exe18⤵
- Executes dropped EXE
PID:1704 -
\??\c:\5xrllrx.exec:\5xrllrx.exe19⤵
- Executes dropped EXE
PID:1348 -
\??\c:\fxrfffl.exec:\fxrfffl.exe20⤵
- Executes dropped EXE
PID:2488 -
\??\c:\5tntbb.exec:\5tntbb.exe21⤵
- Executes dropped EXE
PID:556 -
\??\c:\hbbbbb.exec:\hbbbbb.exe22⤵
- Executes dropped EXE
PID:608 -
\??\c:\3pjjp.exec:\3pjjp.exe23⤵
- Executes dropped EXE
PID:3020 -
\??\c:\5flxfrf.exec:\5flxfrf.exe24⤵
- Executes dropped EXE
PID:680 -
\??\c:\9hntbb.exec:\9hntbb.exe25⤵
- Executes dropped EXE
PID:2584 -
\??\c:\hbntbh.exec:\hbntbh.exe26⤵
- Executes dropped EXE
PID:1916 -
\??\c:\hbbbhh.exec:\hbbbhh.exe27⤵
- Executes dropped EXE
PID:1620 -
\??\c:\vvjjp.exec:\vvjjp.exe28⤵
- Executes dropped EXE
PID:2348 -
\??\c:\3jjdp.exec:\3jjdp.exe29⤵
- Executes dropped EXE
PID:1456 -
\??\c:\xxfflfr.exec:\xxfflfr.exe30⤵
- Executes dropped EXE
PID:1256 -
\??\c:\xrlxxxl.exec:\xrlxxxl.exe31⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vjvvp.exec:\vjvvp.exe32⤵
- Executes dropped EXE
PID:868 -
\??\c:\9jjjd.exec:\9jjjd.exe33⤵
- Executes dropped EXE
PID:1968 -
\??\c:\llflxfx.exec:\llflxfx.exe34⤵
- Executes dropped EXE
PID:900 -
\??\c:\bbtbhb.exec:\bbtbhb.exe35⤵
- Executes dropped EXE
PID:1956 -
\??\c:\7btbnb.exec:\7btbnb.exe36⤵
- Executes dropped EXE
PID:2428 -
\??\c:\ppdjp.exec:\ppdjp.exe37⤵
- Executes dropped EXE
PID:2052 -
\??\c:\1fllxxl.exec:\1fllxxl.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\7rrfffr.exec:\7rrfffr.exe39⤵
- Executes dropped EXE
PID:3032 -
\??\c:\bbhtbn.exec:\bbhtbn.exe40⤵PID:2736
-
\??\c:\bnnbhb.exec:\bnnbhb.exe41⤵
- Executes dropped EXE
PID:2864 -
\??\c:\9lllrxl.exec:\9lllrxl.exe42⤵
- Executes dropped EXE
PID:2640 -
\??\c:\rrflllx.exec:\rrflllx.exe43⤵
- Executes dropped EXE
PID:2964 -
\??\c:\1nbtbn.exec:\1nbtbn.exe44⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hhhttb.exec:\hhhttb.exe45⤵
- Executes dropped EXE
PID:2860 -
\??\c:\jdpjv.exec:\jdpjv.exe46⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jjppv.exec:\jjppv.exe47⤵
- Executes dropped EXE
PID:1448 -
\??\c:\jpvjp.exec:\jpvjp.exe48⤵
- Executes dropped EXE
PID:2300 -
\??\c:\7fxlxfx.exec:\7fxlxfx.exe49⤵
- Executes dropped EXE
PID:676 -
\??\c:\tnhnth.exec:\tnhnth.exe50⤵
- Executes dropped EXE
PID:2812 -
\??\c:\3thhbn.exec:\3thhbn.exe51⤵
- Executes dropped EXE
PID:2920 -
\??\c:\1ddpp.exec:\1ddpp.exe52⤵
- Executes dropped EXE
PID:1888 -
\??\c:\jjjjd.exec:\jjjjd.exe53⤵
- Executes dropped EXE
PID:2000 -
\??\c:\lfrxfll.exec:\lfrxfll.exe54⤵
- Executes dropped EXE
PID:2932 -
\??\c:\9lfxllf.exec:\9lfxllf.exe55⤵
- Executes dropped EXE
PID:2016 -
\??\c:\tntthh.exec:\tntthh.exe56⤵
- Executes dropped EXE
PID:2148 -
\??\c:\3ntbnn.exec:\3ntbnn.exe57⤵
- Executes dropped EXE
PID:1876 -
\??\c:\hhbbhn.exec:\hhbbhn.exe58⤵
- Executes dropped EXE
PID:1812 -
\??\c:\jpjpv.exec:\jpjpv.exe59⤵
- Executes dropped EXE
PID:684 -
\??\c:\dddjd.exec:\dddjd.exe60⤵
- Executes dropped EXE
PID:380 -
\??\c:\xxlrrfr.exec:\xxlrrfr.exe61⤵
- Executes dropped EXE
PID:1720 -
\??\c:\xxflrxr.exec:\xxflrxr.exe62⤵
- Executes dropped EXE
PID:2128 -
\??\c:\bbbntb.exec:\bbbntb.exe63⤵
- Executes dropped EXE
PID:644 -
\??\c:\1hthhb.exec:\1hthhb.exe64⤵
- Executes dropped EXE
PID:824 -
\??\c:\pjvdj.exec:\pjvdj.exe65⤵
- Executes dropped EXE
PID:1952 -
\??\c:\rrffrxx.exec:\rrffrxx.exe66⤵
- Executes dropped EXE
PID:948 -
\??\c:\llfllrx.exec:\llfllrx.exe67⤵PID:1928
-
\??\c:\bbbbhn.exec:\bbbbhn.exe68⤵PID:1620
-
\??\c:\1tnhth.exec:\1tnhth.exe69⤵PID:2952
-
\??\c:\1jdpp.exec:\1jdpp.exe70⤵PID:2212
-
\??\c:\vvdjp.exec:\vvdjp.exe71⤵PID:2192
-
\??\c:\rrlrxrx.exec:\rrlrxrx.exe72⤵
- System Location Discovery: System Language Discovery
PID:600 -
\??\c:\ffflfrf.exec:\ffflfrf.exe73⤵PID:1760
-
\??\c:\bbbhnn.exec:\bbbhnn.exe74⤵PID:1644
-
\??\c:\nhbnbh.exec:\nhbnbh.exe75⤵PID:2172
-
\??\c:\jddvv.exec:\jddvv.exe76⤵PID:2328
-
\??\c:\dpppp.exec:\dpppp.exe77⤵PID:2108
-
\??\c:\fffrxlx.exec:\fffrxlx.exe78⤵PID:900
-
\??\c:\frxlrrf.exec:\frxlrrf.exe79⤵PID:2476
-
\??\c:\tthnbt.exec:\tthnbt.exe80⤵PID:1804
-
\??\c:\nnhhtt.exec:\nnhhtt.exe81⤵PID:2848
-
\??\c:\vvvvj.exec:\vvvvj.exe82⤵PID:2892
-
\??\c:\vvppd.exec:\vvppd.exe83⤵PID:2804
-
\??\c:\rxrrrxl.exec:\rxrrrxl.exe84⤵PID:2260
-
\??\c:\rlflxrx.exec:\rlflxrx.exe85⤵PID:1524
-
\??\c:\3hbttn.exec:\3hbttn.exe86⤵PID:2964
-
\??\c:\7bnnhh.exec:\7bnnhh.exe87⤵PID:1900
-
\??\c:\jdvvj.exec:\jdvvj.exe88⤵PID:2732
-
\??\c:\1dddd.exec:\1dddd.exe89⤵PID:2136
-
\??\c:\fxrrflr.exec:\fxrrflr.exe90⤵PID:804
-
\??\c:\xrxlxff.exec:\xrxlxff.exe91⤵PID:904
-
\??\c:\bbtbbh.exec:\bbtbbh.exe92⤵PID:1132
-
\??\c:\9tbnbh.exec:\9tbnbh.exe93⤵PID:2956
-
\??\c:\dvvdj.exec:\dvvdj.exe94⤵PID:1196
-
\??\c:\vpvvd.exec:\vpvvd.exe95⤵PID:2072
-
\??\c:\fxlflfl.exec:\fxlflfl.exe96⤵PID:1732
-
\??\c:\fxrxllr.exec:\fxrxllr.exe97⤵PID:2008
-
\??\c:\tnntht.exec:\tnntht.exe98⤵PID:2948
-
\??\c:\7ttntb.exec:\7ttntb.exe99⤵PID:1556
-
\??\c:\3dvdj.exec:\3dvdj.exe100⤵PID:1704
-
\??\c:\dvvdd.exec:\dvvdd.exe101⤵PID:1348
-
\??\c:\xxrrffr.exec:\xxrrffr.exe102⤵PID:2424
-
\??\c:\3lfflrx.exec:\3lfflrx.exe103⤵PID:2488
-
\??\c:\hbnthh.exec:\hbnthh.exe104⤵PID:1564
-
\??\c:\bbtntt.exec:\bbtntt.exe105⤵PID:2372
-
\??\c:\vpjpd.exec:\vpjpd.exe106⤵PID:2024
-
\??\c:\vpdjv.exec:\vpdjv.exe107⤵PID:2504
-
\??\c:\xrfflfl.exec:\xrfflfl.exe108⤵PID:408
-
\??\c:\nnhttb.exec:\nnhttb.exe109⤵PID:824
-
\??\c:\nnbhhh.exec:\nnbhhh.exe110⤵PID:1532
-
\??\c:\dddpv.exec:\dddpv.exe111⤵PID:2256
-
\??\c:\ppppv.exec:\ppppv.exe112⤵PID:2104
-
\??\c:\5rllrfx.exec:\5rllrfx.exe113⤵PID:976
-
\??\c:\xrrxxfl.exec:\xrrxxfl.exe114⤵PID:268
-
\??\c:\1tnhtt.exec:\1tnhtt.exe115⤵
- System Location Discovery: System Language Discovery
PID:2080 -
\??\c:\hhbbnn.exec:\hhbbnn.exe116⤵PID:1780
-
\??\c:\1jdpp.exec:\1jdpp.exe117⤵PID:2168
-
\??\c:\fxrfxll.exec:\fxrfxll.exe118⤵PID:2400
-
\??\c:\3xxxfll.exec:\3xxxfll.exe119⤵PID:1908
-
\??\c:\nnhnbb.exec:\nnhnbb.exe120⤵PID:1012
-
\??\c:\hbtttt.exec:\hbtttt.exe121⤵PID:2060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-